THINGS YOU WISH YOU DIDN'T NEED TO KNOW ABOUT SERVICE-LINKED ROLES

Summary from the TLDR InfoSec newsletter

AWS Service-Linked Roles (SLRs) are a special class of IAM roles managed by AWS and used to bootstrap services or resources within services that depend on other services. SLRs are largely undocumented, so the author of this post used the undocumented iamv2 API to enumerate the trust policies and IAM policies of the SLRs used by as many services as they could find. They discovered several “code smells” in the IAM policies, such as a lack of confused-deputy protection, resource policies that use wildcards, tag-based policies, or name-based policies.