The Confused Deputy Problem in AWS: ExternalId, aws:Source* Keys, and RCPs

Most IAM incidents people talk about start with a leaked access key or a wildcard that was too...