ROLES HERE? ROLES THERE? ROLES ANYWHERE: EXPLORING THE SECURITY OF AWS IAM ROLES ANYWHERE

Summary from the TLDR InfoSec newsletter

AWS IAM Roles Anywhere is a method for authenticating to AWS using certificates signed by a configured trust anchor. By default, the Roles Anywhere policy does not include any conditions, and any role attached to it could be assumed by any request signed by any trust anchor in that region. Unit 42 recommends specifying an ARN using conditions in the default policy, utilizing ACM-PCA for the trust anchor, and adhering to the principle of least privilege.