resilience-hub-multi-account
Pass
Audited by Gen Agent Trust Hub on Jul 23, 2026
Risk Level: SAFE
Full Analysis
- [Secure IAM Configuration]: The skill provides detailed instructions for creating IAM roles with robust security controls. It specifically mandates the use of condition keys such as
aws:SourceAccount,sts:ExternalId, andaws:PrincipalOrgIDin trust policies to prevent cross-account security risks. - [Least Privilege Architecture]: Recommendations consistently prioritize least-privilege access, specifically advising that member-account roles be restricted to read-only discovery actions rather than granting broad administrative or write permissions.
- [Safe Secret Management]: The procedure includes clear guidance on managing sensitive values like the
externalId. It recommends generating these values using secure random generators and storing them in dedicated services like AWS Secrets Manager or SSM Parameter Store, rather than hardcoding them in scripts or templates. - [Confused-Deputy Mitigation]: The skill includes explicit warnings and architectural requirements to use the external ID mechanism and source account conditions, which are standard AWS defenses against the confused-deputy problem in cross-account interactions.
- [Informative Security Documentation]: External references point exclusively to official AWS security documentation and industry-standard best practices.
Audit Metadata