Notifications
Clear all
Topic starter
25/08/2026 6:10 pm
TL;DR: AWS IAM Roles Anywhere extends certificate-based access to external workloads, but Veza’s analysis shows that broad trust anchors, stale revocation data, over-permissive profiles, and weak attribution can leave hidden non-human identities with persistent AWS access to customer PII. The governance gap is not authentication alone, but lifecycle control over who can issue, revoke, and map certificates to effective privilege.
NHIMG editorial — based on content published by Veza: AWS IAM Roles Anywhere access risks and NHI governance gaps
By the numbers:
- 72% of identity professionals find machine identities more challenging to manage than human identities, citing poor internal processes and insufficient tooling.
- Only 38% have automated certificate lifecycle management in place.
- 57% of organisations lack a complete inventory of their machine identities.
Questions worth separating out
Q: What breaks when certificate revocation is not enforced for external workload identities?
A: A revoked certificate can continue to authenticate if revocation checks are stale or incomplete, which turns a cut-off control into a paper exercise.
Q: Why do certificate-based workload identities increase cloud governance risk?
A: They increase risk when trust anchors are broad, ownership is unclear, and role mappings are more permissive than the workload needs.
Q: How do security teams know if Roles Anywhere profiles are too permissive?
A: They are too permissive when the certificate can assume roles that reach data or services unrelated to the workload's documented function.
Practitioner guidance
- Tighten certificate issuance boundaries Limit each trust anchor to the smallest realistic workload population and require explicit ownership metadata for every certificate chain.
- Verify revocation enforcement end to end Test that revoked certificates are rejected in the actual access path, not just marked inactive in a control console or policy record.
- Audit certificate-to-role mappings Review every Roles Anywhere profile for over-broad role assumption and remove mappings that grant access beyond the workload's documented purpose.
What's in the full article
Veza's full analysis covers the operational detail this post intentionally leaves for the source:
- Exact discovery logic for AWS IAM Roles Anywhere trust anchors, CRLs, and profiles across cloud estates
- The end-to-end certificate-to-role-to-permission mapping workflow used to expose hidden access paths
- Practical query examples for finding orphaned or over-permissive profiles before they become persistent exposure
- The breadth of AWS service coverage, including S3, EC2, and KMS, that implementation teams will want to validate
👉 Read Veza's analysis of AWS IAM Roles Anywhere NHI governance risks →
AWS IAM Roles Anywhere: what access risks are teams missing?
Explore further
25/08/2026 6:11 pm
Broad certificate trust is an identity boundary problem, not just an AWS feature choice. Roles Anywhere collapses the gap between external workload authentication and AWS authorization, which means the certificate authority becomes part of the enterprise identity perimeter. If a single CA can issue credentials to many systems, the real problem is trust domain sprawl. Practitioners should treat the CA, the certificate, and the role mapping as one governed identity chain.
A few things that frame the scale:
- 72% of identity professionals find machine identities more challenging to manage than human identities, according to The Critical Gaps in Machine Identity Management report.
- 57% of organisations lack a complete inventory of their machine identities, according to The Critical Gaps in Machine Identity Management report.
A question worth separating out:
Q: Who should be accountable for orphaned certificate-based access?
A: The accountable owner should be the team that owns the workload, the CA, and the revocation process together. If those responsibilities are split, orphaned certificates can remain active after systems are retired or vendors change. Accountability has to follow the lifecycle of the identity, not just the infrastructure it runs on.
👉 Read our full editorial: AWS IAM Roles Anywhere exposes hidden NHI trust gaps
