WHY RECREATING AN IAM ROLE DOESN'T RESTORE TRUST: A GOTCHA IN ROLE ARNS

Summary from the TLDR InfoSec newsletter

In AWS IAM, trust policies reference ARNs in their JSON but reference an underlying, immutable principal ID, so if a role is deleted and recreated, the trust policy will also need to be recreated, even if the ARN is unchanged. This provides a security benefit in that if a role is deleted but the trust policy is unintentionally not updated, the role cannot be stealthily recreated and assume the same level of trust. Users can get around this issue by using a complete account as the principal in a trust policy with a condition block that restricts access to the specific role ARN.