🔐 sts:ExternalId 完全マスターガイド

// ExternalIdを必須にした信頼ポリシー
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        // SaaSサービスのAWSアカウント
        "AWS": "arn:aws:iam::999999999999:root"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          // ★ ここがポイント！ExternalIdの検証
          "sts:ExternalId": "a1b2c3d4-unique-secret-12345"
        }
      }
    }
  ]
}

AWSTemplateFormatVersion: '2010-09-09'
Description: 'ExternalId付きクロスアカウントロール'

Parameters:
  ExternalId:
    Type: String
    Description: 'SaaSサービスから提供されたExternalId'
    NoEcho: true  # 機密情報として扱う

Resources:
  CrossAccountRole:
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: 'SaaSServiceRole'
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              AWS: 'arn:aws:iam::999999999999:root'
            Action: 'sts:AssumeRole'
            Condition:
              StringEquals:
                sts:ExternalId: !Ref ExternalId

variable "external_id" {
  description = "SaaSサービスから提供されたExternalId"
  type        = string
  sensitive   = true  # 機密情報として扱う
}

resource "aws_iam_role" "saas_service_role" {
  name = "SaaSServiceRole"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Principal = {
          AWS = "arn:aws:iam::999999999999:root"
        }
        Action = "sts:AssumeRole"
        Condition = {
          StringEquals = {
            "sts:ExternalId" = var.external_id
          }
        }
      }
    ]
  })
}

# AWS CLI
aws sts assume-role \
  --role-arn "arn:aws:iam::111111111111:role/SaaSServiceRole" \
  --role-session-name "SaaSSession" \
  --external-id "a1b2c3d4-unique-secret-12345"

# Python (boto3)
import boto3

sts_client = boto3.client('sts')
response = sts_client.assume_role(
    RoleArn='arn:aws:iam::111111111111:role/SaaSServiceRole',
    RoleSessionName='SaaSSession',
    ExternalId='a1b2c3d4-unique-secret-12345'  # 必須！
)

credentials = response['Credentials']