[Contribution] AWS: IAM role trust policy condition validation bug

[Frichetten]

Summary

the tag variable names affected whether trust policy conditions were evaluated correctly.

If the request tag referenced a principal tag called MemberRole in the JWT token, and the IAM role referenced a resource tag with the same variable name, the condition was always evaluated as true, regardless of whether the tag's values actually matched. This is how test users with stedi:readonly permissions in Stedi gained unauthorized admin access to their AWS accounts.

References (provide links to blogposts, etc.)

We discovered an AWS access vulnerability