A SAAS PROVIDER'S GUIDE TO SECURELY INTEGRATING WITH CUSTOMERS' AWS ACCOUNTS

Summary from the TLDR InfoSec newsletter

SaaS providers often need to integrate with customers' AWS environments to perform a variety of tasks such as cost optimization or CSPM. The basics that a provider can do are to use IAM Roles with ExternalIDs instead of IAM users and to audit and minimize permissions that your role requires. Some paved roads and guardrails that providers can then take would be to provide CloudFormation templates and/or a Terraform provider as well as refusing to assume an overly permissive role. Finally, providers should treat their integrations as crown jewels and consider using defense-in-depth models such as bastion accounts and restricting the customer's trust boundary to a single role instead of a full account.