Least privilege recommendations
Follow these recommendations to apply least privilege principles to your Next generation Resilience Hub configuration:
-
Use ExternalId for cross-account roles – The
ExternalIdcondition in cross-account trust policies prevents confused deputy attacks. -
Use Organizations Service-Linked Roles – Avoid manual cross-account role setup when possible. Service-Linked Roles provide automatically scoped, auditable access.
