[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/) [![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/) Menu * [Tools](https://unit42.paloaltonetworks.com/tools/) * [ATOMs](https://unit42.paloaltonetworks.com/atoms/) * [Security Consulting](https://www.paloaltonetworks.com/unit42) * [About Us](https://unit42.paloaltonetworks.com/about-unit-42/) * [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html) English * [English](https://unit42.paloaltonetworks.com/aws-roles-anywhere/) * [Spanish (LATAM)](https://unit42.paloaltonetworks.com/es-la/aws-roles-anywhere/) * [French](https://unit42.paloaltonetworks.com/fr/aws-roles-anywhere/) * [Japanese](https://unit42.paloaltonetworks.com/ja/aws-roles-anywhere/) * [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/ "Threat Research") * [Cloud Cybersecurity Research](https://unit42.paloaltonetworks.com/category/cloud-cybersecurity-research/ "Cloud Cybersecurity Research") [Cloud Cybersecurity Research](https://unit42.paloaltonetworks.com/category/cloud-cybersecurity-research/) # Roles Here? Roles There? Roles Anywhere: Exploring the Security of AWS IAM Roles Anywhere ![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 12 min read Related Products [![Cortex icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex](https://unit42.paloaltonetworks.com/product-category/cortex/ "Cortex")[![Cortex Cloud icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex Cloud](https://unit42.paloaltonetworks.com/product-category/cortex-cloud/ "Cortex Cloud")[![Cortex XSOAR icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex XSOAR](https://unit42.paloaltonetworks.com/product-category/cortex-xsoar/ "Cortex XSOAR")[![Unit 42 Incident Response icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/unit42_RGB_logo_Icon_Color.png)Unit 42 Incident Response](https://unit42.paloaltonetworks.com/product-category/unit-42-incident-response/ "Unit 42 Incident Response") * ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg) By: * [Itay Saraf](https://unit42.paloaltonetworks.com/author/itay-saraf/) * ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg) Published:June 9, 2025 * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg) Categories: * [Cloud Cybersecurity Research](https://unit42.paloaltonetworks.com/category/cloud-cybersecurity-research/) * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg) Tags: * [AWS](https://unit42.paloaltonetworks.com/tag/aws/) * [Kubernetes](https://unit42.paloaltonetworks.com/tag/kubernetes/) * [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/aws-roles-anywhere/?pdf=download&lg=en&_wpnonce=fafa58d2d0 "Click here to download") * [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/aws-roles-anywhere/?pdf=print&lg=en&_wpnonce=fafa58d2d0 "Click here to print") Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg) * ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg) * [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=Roles%20Here?%20Roles%20There?%20Roles%20Anywhere:%20Exploring%20the%20Security%20of%20AWS%20IAM%20Roles%20Anywhere&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Faws-roles-anywhere%2F "Share in email") * [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Faws-roles-anywhere%2F "Share in Facebook") * [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Faws-roles-anywhere%2F&title=Roles%20Here?%20Roles%20There?%20Roles%20Anywhere:%20Exploring%20the%20Security%20of%20AWS%20IAM%20Roles%20Anywhere "Share in LinkedIn") * [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Faws-roles-anywhere%2F&text=Roles%20Here?%20Roles%20There?%20Roles%20Anywhere:%20Exploring%20the%20Security%20of%20AWS%20IAM%20Roles%20Anywhere "Share in Twitter") * [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Faws-roles-anywhere%2F&ts=markdown "Share in Reddit") * [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=Roles%20Here?%20Roles%20There?%20Roles%20Anywhere:%20Exploring%20the%20Security%20of%20AWS%20IAM%20Roles%20Anywhere%20https%3A%2F%2Funit42.paloaltonetworks.com%2Faws-roles-anywhere%2F "Share in Mastodon") ## Executive Summary As organizations depend more on applications, devices and services to interact across hybrid environments, non-human identities are becoming more common. To enable secure access for these identities within the organization, Amazon Web Services (AWS) has introduced the [AWS Identity and Access Management (IAM) Roles Anywhere](https://docs.aws.amazon.com/rolesanywhere/latest/userguide/introduction.html) service that allows workloads outside of AWS to authenticate using digital certificates instead of traditional access keys. The AWS IAM Roles Anywhere service offers organizations several security advantages and it is relatively simple to configure, especially for an organization that already has a public key infrastructure (PKI). Usually, implementation of this service requires organizations to carefully consider least privilege and access permissions when designing the infrastructure. Failure to implement proper security controls and practical defense-in-depth architectures could allow an organization to inadvertently open their cloud environment to unwanted exposures. In this article, we explore key risks associated with improper configuration or architectural design while using the Roles Anywhere service. These risks come from a common root cause. The service's default configuration is relatively permissive within the context of the AWS account and region where the service is configured for use. We analyze these risks from both a threat actor's perspective and an organization's perspective. This exploration should help readers better understand the potential risks involved when designing the usage of this service and how organizations mitigate them. [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud) provides protections against the Public Key Infrastructure (PKI) misconfigurations detailed within this article. By using both Cloud XDR Agent based rules, as well as behavioral analytic rules, to detect when [IAM](https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Analytics-Alert-Reference-by-data-source/Unusual-Identity-and-Access-Management-IAM-activity) policies are being misused, Cortex Cloud is able to detect and prevent malicious operations using its [XSOAR](https://docs-cortex.paloaltonetworks.com/p/XSOAR) platform automation capabilities. Organizations can gain help assessing cloud security posture through the [Unit 42 Cloud Security Assessment](https://www.paloaltonetworks.com/resources/datasheets/unit-42-cloud-security-assessment). If you think you might have been compromised or have an urgent matter, contact the [Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html). | **Related Unit 42 Topics** | [**AWS**](https://unit42.paloaltonetworks.com/tag/aws/), **[Kubernetes](https://unit42.paloaltonetworks.com/tag/kubernetes/)** | |----------------------------|--------------------------------------------------------------------------------------------------------------------------------| ## Introduction Roles Anywhere is an access management service that was first introduced in 2022. It enables external workloads to authenticate to AWS using X.509 digital certificates. This capability eliminates the need to create and manage long-term credentials in such workloads and ultimately makes cloud API operations more secure and easier to manage within AWS environments. To state it simply, Roles Anywhere can be used to define which certificate authority (CA) certificates are eligible to validate clients' certificates. A client certificate that is signed by such a CA can be used to: * Authenticate to AWS * Trade the certificate-based identity for a corresponding cloud-native identity (expressed as a set of temporary credentials) * Call AWS cloud APIs as normal by signing requests with those temporary AWS credentials ## Key Components and Concepts The authentication process consists of several core components: * **Trust anchors:** A trust anchor is the resource that represents the CA certificate in Roles Anywhere. When a trust anchor is created, a CA certificate must be attached to it. There are two types of trust anchors: * AWS Certificate Manager-Private Certificate Authority (**ACM-PCA)** certificate: This is a managed AWS resource. * **Certificate Bundle**: An X.509 certificate encoded in Privacy-Enhanced Mail (PEM) ASCII format that is attached to the trust anchor directly. * **Profiles:** These are resources that determine the level of access for an entity that is authenticated with Roles Anywhere. Profiles are assigned with identity and access management (IAM) roles that define the permissions and with additional mechanisms to fine-tune the permissions. * **IAM Roles:** The IAM roles are assigned with the actual IAM policies that grant (or remove) permissions. ![Diagram illustrating the process of sending credentials to a client using AWS identities. It shows a device with a client certificate initiating a 'Create-Session request signed with private key', interacting with 'Trust Anchor ARN, Profile ARN, Role ARN', and confirming through IAM Role and Profile, resulting in credentials being sent to the client.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/06/word-image-836772-142575-1.png) Figure 1. High-level view of the authentication process. In practice, authentication using Roles Anywhere is made by sending a request to the /sessions endpoint. The request is signed with the private key of the certificate and takes as its parameters the Amazon Resource Name (ARN) of the Trust Anchor, as well as the ARNs of the Profile and Role. An easy way to compose the request is by using the [aws\_signing\_helper](https://docs.aws.amazon.com/rolesanywhere/latest/userguide/credential-helper.html) tool. This tool automates the authentication process, and it can also make the credentials available locally by emulating the Instance Metadata Service endpoint in much the same way that Amazon Elastic Compute Cloud (EC2) instances work. Figure 2 shows examples of requests and responses using Roles Anywhere. ![Screenshot showing an API request and response in Postman interface. The request tab highlights a GET command querying AWS credentials with Amazon's URL, while the response tab displays returned AWS credentials, including 'AccessKeyId', 'SecretAccessKey', and 'SessionToken'. Some of the information is redacted for privacy.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/06/word-image-839795-142575-2.png) Figure 2. Request and response examples for authentication using Roles Anywhere. ### Regular Usage of Roles Anywhere To better understand the configuration flow of Roles Anywhere, consider the following scenario: * A Kubernetes pod outside of AWS requires access to read objects in a Simple Storage Service (S3) bucket. * The cloud engineer issues a certificate and signs it using the Trust Anchor's certificate. The signed certificate is then stored in the pod, together with its private key. * The engineer creates an IAM role that includes the relevant S3 permissions and attaches it to a Roles Anywhere profile. * The Kubernetes pod can now use the certificate, as well as its associated role credentials, along with the key to sign, authenticate and read objects within the configured S3 bucket. ## Securing the Default Authentication Process One interesting aspect of this authentication process is that by default, there is no correlation between the trust anchor and a specific profile. It is crucial for organizations to understand the risks involved with this setup and configure the Roles Anywhere resources and the IAM roles trust policies accordingly. In other words, organizations must configure a client certificate to be signed by a specific trust anchor and destined to a specific profile. This will prevent access from any other profile and trust anchor in the same AWS account and region. To demonstrate the possible consequences of this process, consider the pod scenario outlined above. So far, the steps in the flow are legitimate. For all intents and purposes, the pod has the exact permissions it needs. But what if an attacker obtains access to the pod? If other profiles were created in the same AWS account and region, the attacker may use the certificate to get access to the roles of these profiles: * The attacker deduces the ARNs of another IAM role that is attached to the same profile or the ARNs and attached roles of another profile. Deducing these ARNs is a complex task that requires additional permissions to the AWS environment. We discuss these techniques [later in this article](#post-142575-_cojl8gu5lncl). * Having obtained all the necessary information, the attacker can now formulate requests to obtain credentials of different roles and use their permissions to conduct malicious operations. AWS [provides several ways](https://docs.aws.amazon.com/rolesanywhere/latest/userguide/trust-model.html) to limit access from Roles Anywhere by using **conditions** in the role's trust policy. However, the **Roles Anywhere default trust policy** **has no condition in its statement**, meaning that any environment using the default policy does not impose access limitations. It is the organization's responsibility to ensure they are not using default configurations for Roles Anywhere configurations. When a default role that is used for Roles Anywhere is created, the following trust policy is set: { "Version": "2012-10-17", "Statement": \[ { "Sid": "", "Effect": "Allow", "Principal": { "Service": "rolesanywhere.amazonaws.com" }, "Action": \[ "sts:AssumeRole", "sts:SetSourceIdentity", "sts:TagSession" \] } \] } |-------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 | { "Version": "2012-10-17", "Statement": \[ { "Sid": "", "Effect": "Allow", "Principal": { "Service": "rolesanywhere.amazonaws.com" }, "Action": \[ "sts:AssumeRole", "sts:SetSourceIdentity", "sts:TagSession" \] } \] } | **This policy states that this role can be assumed by the Roles Anywhere service**. However, there are no other restrictions for the sources that can assume it. This means that if a role is attached to a profile, any certificate that is signed by a trust anchor in the same region can assume this role. To address this, AWS created the Condition section in the policy. Conditions enable additional restrictions on resources, specifying the requirements these resources must meet to carry out an action. The following policy adds a Condition section on top of the default policy, to limit the access of Roles Anywhere authentication to the role, only from a specific trust anchor. { "Version": "2012-10-17", "Statement": \[ { "Sid": "", "Effect": "Allow", "Principal": { "Service": "rolesanywhere.amazonaws.com" }, "Action": \[ "sts:AssumeRole", "sts:SetSourceIdentity", "sts:TagSession" \], "Condition": { "ArnEquals": { "aws:SourceArn": \[ "arn:aws:rolesanywhere:region:account:trust-anchor/TA\_ID" \] } } } \] } |-------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 | { "Version": "2012-10-17", "Statement": \[ { "Sid": "", "Effect": "Allow", "Principal": { "Service": "rolesanywhere.amazonaws.com" }, "Action": \[ "sts:AssumeRole", "sts:SetSourceIdentity", "sts:TagSession" \], "Condition": { "ArnEquals": { "aws:SourceArn": \[ "arn:aws:rolesanywhere:region:account:trust-anchor/TA\_ID" \] } } } \] } | To further limit the access of signed certificates, we recommend taking advantage of the **certificate attribute mapping** . AWS also recommends this in the [Roles Anywhere documentation](https://docs.aws.amazon.com/rolesanywhere/latest/userguide/trust-model.html): ![Notification with warning icon and "Important" in bold before displaying a recommended action from AWS.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/06/word-image-842540-142575-3.png) Figure 3. AWS recommendation to use attribute mapping. Essentially, it is possible to map a certificate's attributes to values that will be evaluated in the trust policy. People can use this to specify access to roles based on the certificate's Common Name, Organization Unit or any other attribute in the certificate. This is recommended because it ensures that if a resource that uses Roles Anywhere for authentication is compromised, it will not be able to access additional roles. The following condition uses the trust anchor condition from the last section and also limits access based on the certificate's attributes: "Condition": { "ArnEquals": { "aws:SourceArn": \[ "arn:aws:rolesanywhere:region:account:trust-anchor/TA\_ID" \] }, "StringEquals": { "aws:PrincipalTag/x509Subject/CN": "COMMON\_NAME" } } |-------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 | "Condition": { "ArnEquals": { "aws:SourceArn": \[ "arn:aws:rolesanywhere:region:account:trust-anchor/TA\_ID" \] }, "StringEquals": { "aws:PrincipalTag/x509Subject/CN": "COMMON\_NAME" } } | As with any other service, the principle of least privilege should be considered when implementing Roles Anywhere infrastructure. Certificate attribute mapping should be used to accomplish this. ## Threat Actor's Perspective ### Scenario \#1 - Attacker's Use of Valid Certificates and Private Keys As outlined above, the following pieces of information are needed to authenticate using Roles Anywhere: * The client certificate * The client certificate's private key * The ARN of the trust anchor that signed the certificate * The ARN of a profile in the same region * The ARN of an IAM role that is attached to the profile In the following scenario, an attacker compromises a default Roles Anywhere configuration for a client certificate that is used for authentication with its private key. To maliciously leverage the default configuration to access additional roles in the account the attacker still needs to discover the ARNs of the relevant resources to authenticate to AWS. Obtaining the ARNs is not a straightforward task and requires additional independent privileges inside the account. The following techniques can be used to obtain this information: **Using Roles Anywhere actions:** An attacker who has gained sufficient permissions to the Roles Anywhere service can simply execute actions to obtain the relevant ARNs. They can do this using the list-trust-anchors and list-profiles actions, which require the rolesanywhere:ListTrustAnchors and rolesanywhere:ListProfiles permissions, respectively. The output of these actions contains all the necessary ARNs for the authentication request, as the list-profiles command will return all the roles that are attached to the profile. **Retrieving data from logs:** [CloudTrail](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-user-guide.html) is the main logging mechanism of AWS. Among CloudTrail logs, an attacker with independent access to CloudTrail logs (or to storage services that contain them) could locate items that are created by the Roles Anywhere service. Some CloudTrail logs contain all the ARNs required for the authentication process. Logs of the Roles Anywhere service disclose these ARNs in the events of several actions. The most relevant log is CreateSession. This log is created when Roles Anywhere is used for authentication, in other words, to create temporary credentials and send them to the user. Figure 3 shows an example of a CreateSession log entry and notes the associated ARN. ![A screenshot of a JSON code snippet with various key-value pairs, highlighting an AWS IAM role creation event with associated role and policy ARNs.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/06/word-image-845744-142575-4.png) Figure 4. CreateSession CloudTrail log. The ARNs of a trust anchor, a profile and one of its attached roles appear in this event log. If the attacker's certificate was signed by the trust anchor that appears in the log, they can use it to perform authentication. Figure 5 shows a high-level illustration of the attackers' steps. ![Diagram illustrating a cybersecurity attack where a malicious entity grabs a certificate and key from a pod, using credentials and ARNs to connect to different profiles including pod, storage, and database profiles, linked to trust anchors in the cloud.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/06/word-image-848348-142575-5.png) Figure 5. High-level view of the attackers' steps. ### Scenario \#2 - Exploiting Direct Permissions to Roles Anywhere Another scenario in which a default configuration of the Roles Anywhere service could be exploited is when an attacker gains access to an identity that has Roles Anywhere permissions. These permissions may be granted by a direct Allow statement on the service or through the NotAction element. The following steps can be used to take advantage of these permissions: * The attacker gains access to an identity that has Roles Anywhere default configurations and permissions. * The attacker creates two certificates --- a CA certificate and a client certificate --- and then uses the CA certificate to sign the client certificate. Having created the certificates, the attacker also owns their private keys. * The attacker uses the compromised identity to create a trust anchor and attaches the CA certificate to the anchor. * Using list permissions of Roles Anywhere, the attacker gathers profiles and IAM roles ARNs. * Using the ARNs, the client certificate and its private key, the attacker authenticates using Roles Anywhere. * If the trust policy of the IAM role denies access, the attacker can check the Roles Anywhere subjects to find details about a certificate that was previously used for authentication and copy its fields to a new client certificate. In more detail, an attacker with sufficient Roles Anywhere permissions can create a certificate, sign it with the attacker's own CA certificate and upload it to a new or existing trust anchor. This requires the rolesanywhere:CreateTrustAnchor or rolesanywhere:UpdateTrustAnchor permissions. Since the attacker controls both the client certificate and the CA certificate, the certificate will be valid. The next step is to understand which profiles and roles are available, by using the Roles Anywhere list-profiles command or any other technique that is mentioned above. With this information, the attacker can create credentials through Roles Anywhere and perform operations in the context of the role that was used. If the target organization's security measures fail to detect the malicious activity, this process also acts as a persistence vector for the attacker, as a trust anchor can be used to generate valid credentials until the issue is resolved. ## Mitigations and Recommendations * **We highly recommend adding conditions to the default trust policy of roles that are used with Roles Anywhere.** As mentioned above, the default policy allows any trust anchor to assume the role. It is crucial to limit the access to the role only from a specific trust anchor --- the one that is used to authenticate the relevant workload. "Condition": { "ArnEquals": { "aws:SourceArn": \[ "arn:aws:rolesanywhere:region:account:trust-anchor/TA\_ID" \] } } |-------------------------------|--------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 5 6 7 8 9 10 11 12 13 | "Condition": { "ArnEquals": { "aws:SourceArn": \[ "arn:aws:rolesanywhere:region:account:trust-anchor/TA\_ID" \] } } | Additional conditions should also be implemented to limit access only for certificates with certain attributes, such as Common Name or Organization. However, these conditions are not a silver bullet, and they can be bypassed under certain circumstances. For example, a bypass might be possible if an attacker was able to extract attribute information from the certificate. * **We recommend using trust anchors of the ACM-PCA type.** When using ACM-PCA, even an attacker who obtains full access to the Roles Anywhere service will not be able to upload their own generated CA certificate to the trust anchor. The trust anchor type cannot be changed, meaning that ACM-PCA permissions (which are uncommon) are needed to authenticate. * This is a crucial point. If the roles that are supposed to be assumed by the trust anchors are using the condition from the previous bullet, they cannot be accessed. We should note that private CAs in AWS have their own security considerations and may also pose a risk if not configured correctly. * **Permissions should always be assigned based on the principle of least privilege.** The ability to authenticate with Roles Anywhere is usually given to non-human identities, and the devices that use this service usually have specific and pre-determined tasks that they need to perform. Therefore, the access level of these identities should not exceed the requirements of the tasks they are assigned to complete. Apart from the IAM roles themselves, it is possible to associate a session policy with a profile. This policy defines the maximum permissions the role can have, when assumed through Roles Anywhere. * **Regularly monitor and track AWS IAM Roles Anywhere resources**: It is crucial to maintain continuous monitoring of trust anchors, profiles and associated resources. Trust anchors and profiles are not created frequently, making their creation or modification suspicious events. Any unexpected changes to these resources should be immediately investigated to ensure no unauthorized activity is occurring. Regular audits and automated alerts can help detect and respond to potential security threats in a timely manner. * Execute the following XQL query in Cortex Query Builder to identify roles that trust the Roles Anywhere service but do not enforce any conditions. dataset = asset\_inventory | filter xdm.asset.type.id = "AWS\_IAM\_ROLE" and xdm.asset.raw\_fields != null | fields xdm.asset.id as asset\_id, xdm.asset.raw\_fields | alter statements = json\_extract\_array(xdm.asset.raw\_fields, "$\['Platform Discovery'\].Role.AssumeRolePolicyDocument.Statement") | arrayexpand statements | alter principal = json\_extract(statements ,"$.Principal") | alter condition = json\_extract(statements, "$.Condition") | alter service1 = json\_extract\_scalar(principal ,"$.Service") | alter service1\_array = if(service1 != null, arraycreate(service1), arraycreate("null")) | alter serviceA = json\_extract\_scalar\_array(principal ,"$.Service") | alter service = if(service1 != null, service1\_array ,serviceA) | arrayexpand service | filter service = "rolesanywhere.amazonaws.com" | fields asset\_id, service, condition, principal, statements, xdm.asset.raw\_fields | alter is\_condition\_empty = if(condition != null, false, true) | filter is\_condition\_empty = true |-------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 | dataset = asset\_inventory | filter xdm.asset.type.id = "AWS\_IAM\_ROLE" and xdm.asset.raw\_fields != null | fields xdm.asset.id as asset\_id, xdm.asset.raw\_fields | alter statements = json\_extract\_array(xdm.asset.raw\_fields, "$\['Platform Discovery'\].Role.AssumeRolePolicyDocument.Statement") | arrayexpand statements | alter principal = json\_extract(statements ,"$.Principal") | alter condition = json\_extract(statements, "$.Condition") | alter service1 = json\_extract\_scalar(principal ,"$.Service") | alter service1\_array = if(service1 != null, arraycreate(service1), arraycreate("null")) | alter serviceA = json\_extract\_scalar\_array(principal ,"$.Service") | alter service = if(service1 != null, service1\_array ,serviceA) | arrayexpand service | filter service = "rolesanywhere.amazonaws.com" | fields asset\_id, service, condition, principal, statements, xdm.asset.raw\_fields | alter is\_condition\_empty = if(condition != null, false, true) | filter is\_condition\_empty = true | ## **Conclusion** This article has explored key risks associated with using default configurations for the Roles Anywhere service in AWS, both from a potential attacker's perspective and a defender's perspective. We have provided several mitigation strategies organizations should implement to better manage the associated risks. We hope that this analysis helps readers better understand the potential vulnerabilities involved in using the default functionality of this service, and how best to mitigate them. One key takeaway from this article is that when using services from cloud providers, it's crucial to thoroughly understand their configurations and architecture rather than relying on them uncritically. * Follow security best practices, least privilege and defense-in-depth strategies. * This helps ensure that services are properly architected and monitored for configuration modifications. * Maintaining runtime monitoring will help to ensure customized cloud platforms operate securely [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud) provides protections against the Public Key Infrastructure (PKI) misconfigurations detailed within this article. By using both Cloud XDR Agent based rules, as well as behavioral analytic rules, to detect when IAM policies are being misused, Cortex Cloud is able to detect and prevent malicious operations using its XSOAR platform automation capabilities. Organizations can gain help assessing cloud security posture through the [Unit 42 Cloud Security Assessment](https://www.paloaltonetworks.com/resources/datasheets/unit-42-cloud-security-assessment). If you think you may have been compromised or have an urgent matter, get in touch with the [Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html) or call: * North America: Toll Free: +1 (866) 486-4842 (866.4.UNIT42) * UK: +44.20.3743.3660 * Europe and Middle East: +31.20.299.3130 * Asia: +65.6983.8730 * Japan: +81.50.1790.0200 * Australia: +61.2.4062.7950 * India: 00080005045107 Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the [Cyber Threat Alliance](https://www.cyberthreatalliance.org). ## Additional Resources * [What Is the Principle of Least Privilege](https://www.paloaltonetworks.com/cyberpedia/what-is-the-principle-of-least-privilege) -- Palo Alto Networks * [The IAM Roles Anywhere trust model](https://docs.aws.amazon.com/rolesanywhere/latest/userguide/trust-model.html) -- Amazon Web Services official documentation Back to top ### Tags * [AWS](https://unit42.paloaltonetworks.com/tag/aws/ "AWS") * [Kubernetes](https://unit42.paloaltonetworks.com/tag/kubernetes/ "Kubernetes") [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: Blitz Malware: A Tale of Game Cheats and Code Repositories](https://unit42.paloaltonetworks.com/blitz-malware-2025/ "Blitz Malware: A Tale of Game Cheats and Code Repositories") ### Table of Contents * ### Related Articles * [The Global Namespace Risk: Universal Bucket Hijacking Technique for Cloud Data Exfiltration](https://unit42.paloaltonetworks.com/cloud-bucket-hijacking-risks/ "article - table of contents") * [Copy Fail: What You Need to Know About the Most Severe Linux Threat in Years](https://unit42.paloaltonetworks.com/cve-2026-31431-copy-fail/ "article - table of contents") * [Cracks in the Bedrock: Agent God Mode](https://unit42.paloaltonetworks.com/exploit-of-aws-agentcore-iam-god-mode/ "article - table of contents") ## Related Cloud Cybersecurity Research Resources ![Pictorial representation of bucket hijacking technique for cloud data exfiltration. Digital illustration of Europe map highlighting network connections and nodes, depicted as glowing points and lines on a dark blue background, emphasizing major cities and connectivity across the continent.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/06/09_Cloud_cybersecurity_research_Overview_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) June 22, 2026 [#### The Global Namespace Risk: Universal Bucket Hijacking Technique for Cloud Data Exfiltration](https://unit42.paloaltonetworks.com/cloud-bucket-hijacking-risks/) * [AWS](https://unit42.paloaltonetworks.com/tag/aws/ "AWS") * [Bucket hijacking](https://unit42.paloaltonetworks.com/tag/bucket-hijacking/ "bucket hijacking") * [Cloud data exfiltration](https://unit42.paloaltonetworks.com/tag/cloud-data-exfiltration/ "cloud data exfiltration") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/cloud-bucket-hijacking-risks/ "The Global Namespace Risk: Universal Bucket Hijacking Technique for Cloud Data Exfiltration") ![Pictorial representation of Vertex AI model uploads. Close-up view of a digital wall displaying various glowing icons, representing a high-tech network interface.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/06/AdobeStock_1270203474-1-786x354.png) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) June 16, 2026 [#### Pickle in the Middle -- Hijacking Vertex AI Model Uploads for Cross-Tenant RCE](https://unit42.paloaltonetworks.com/hijacking-vertex-ai-model/) * [Bucket squatting](https://unit42.paloaltonetworks.com/tag/bucket-squatting/ "bucket squatting") * [Google Cloud](https://unit42.paloaltonetworks.com/tag/google-cloud/ "Google Cloud") * [Joblib](https://unit42.paloaltonetworks.com/tag/joblib/ "joblib") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/hijacking-vertex-ai-model/ "Pickle in the Middle – Hijacking Vertex AI Model Uploads for Cross-Tenant RCE") ![Pictorial representation of Cloud Logging services for defense evasion. A vibrant digital illustration depicting a glowing, neon blue cloud symbol positioned over a circuit board landscape. The cloud symbolizes cloud computing technology, and the landscape features intricate electronic circuits with glowing lines and nodes, suggesting high-tech data transfer and connectivity.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/06/11_Cloud_cybersecurity_research_Overview_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) June 9, 2026 [#### Blinding the Watchmen: Abusing Cloud Logging Services for Defense Evasion and Visibility](https://unit42.paloaltonetworks.com/cloud-logging-defense-evasion/) * [AWS CloudTrail](https://unit42.paloaltonetworks.com/tag/aws-cloudtrail/ "AWS CloudTrail") * [Cloud logging](https://unit42.paloaltonetworks.com/tag/cloud-logging/ "cloud logging") * [Defense evasion](https://unit42.paloaltonetworks.com/tag/defense-evasion/ "defense evasion") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/cloud-logging-defense-evasion/ "Blinding the Watchmen: Abusing Cloud Logging Services for Defense Evasion and Visibility") ![Pictorial representation of ROADtools framework in the cloud. An Asian man wearing glasses sits in front of a computer screen. Reflecting in the glasses are lines indicating analysis. Bright blue city lights illuminate the rest of the image.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/05/10_Cloud_cybersecurity_research_Overview_1920x900-1-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) May 22, 2026 [#### Paved With Intent: ROADtools and Nation-State Tactics in the Cloud](https://unit42.paloaltonetworks.com/roadtools-cloud-attacks/) * [Curious Serpens](https://unit42.paloaltonetworks.com/tag/curious-serpens/ "Curious Serpens") * [Entra ID](https://unit42.paloaltonetworks.com/tag/entra-id/ "Entra ID") * [Microsoft Azure](https://unit42.paloaltonetworks.com/tag/microsoft-azure/ "Microsoft Azure") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/roadtools-cloud-attacks/ "Paved With Intent: ROADtools and Nation-State Tactics in the Cloud") ![Pictorial representation of autonomous AI attack in cloud environments. Digital illustration of a glowing blue brain connected to a network of lines and lights.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/04/12_Cloud_cybersecurity_research_Overview_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) April 23, 2026 [#### Can AI Attack the Cloud? Lessons From Building an Autonomous Cloud Offensive Multi-Agent System](https://unit42.paloaltonetworks.com/autonomous-ai-cloud-attacks/) * [AI](https://unit42.paloaltonetworks.com/tag/ai/ "AI") * [Cloud](https://unit42.paloaltonetworks.com/tag/cloud/ "Cloud") * [Data exfiltration](https://unit42.paloaltonetworks.com/tag/data-exfiltration/ "data exfiltration") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/autonomous-ai-cloud-attacks/ "Can AI Attack the Cloud? Lessons From Building an Autonomous Cloud Offensive Multi-Agent System") ![Pictorial representation of passwordless authentication. Futuristic cityscape with skyscrapers surrounded by glowing, neon-lit pathways and digital clouds. The sky is vibrant with pink and orange hues, giving a surreal, cyberpunk aesthetic.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/02_Cloud_cybersecurity_research_Overview_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) March 23, 2026 [#### Google Cloud Authenticator: The Hidden Mechanisms of Passwordless Authentication](https://unit42.paloaltonetworks.com/passwordless-authentication/) * [Google](https://unit42.paloaltonetworks.com/tag/google/ "Google") * [Google authenticator](https://unit42.paloaltonetworks.com/tag/google-authenticator/ "google authenticator") * [Google Chrome](https://unit42.paloaltonetworks.com/tag/google-chrome/ "Google Chrome") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/passwordless-authentication/ "Google Cloud Authenticator: The Hidden Mechanisms of Passwordless Authentication") ![Close-up of a black woman with glasses examining colorful computer code on a screen. The scene is illuminated by various lights, creating a focused and analytical atmosphere.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/02/13_Cloud_cybersecurity_research_Overview_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) February 6, 2026 [#### Novel Technique to Detect Cloud Threat Actor Operations](https://unit42.paloaltonetworks.com/tracking-threat-groups-through-cloud-logging/) * [API](https://unit42.paloaltonetworks.com/tag/api/ "API") * [IAM](https://unit42.paloaltonetworks.com/tag/iam/ "IAM") * [MITRE](https://unit42.paloaltonetworks.com/tag/mitre/ "MITRE") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/tracking-threat-groups-through-cloud-logging/ "Novel Technique to Detect Cloud Threat Actor Operations") ![Pictorial representation of Azure OpenAI DNS resolution issue. Futuristic cityscape illustration with luminous structures and floating cloud elements, showcasing advanced technology and a dynamic, digitally enhanced environment.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/06/02_DNS_Overview_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) January 20, 2026 [#### DNS OverDoS: Are Private Endpoints Too Private?](https://unit42.paloaltonetworks.com/dos-attacks-and-azure-private-endpoint/) * [Microsoft Azure](https://unit42.paloaltonetworks.com/tag/microsoft-azure/ "Microsoft Azure") * [Networking](https://unit42.paloaltonetworks.com/tag/networking/ "networking") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/dos-attacks-and-azure-private-endpoint/ "DNS OverDoS: Are Private Endpoints Too Private?") ![Pictorial representation of cloud discovery with AzureHound. A digital representation of a cloud composed of blue light particles, superimposed over a blurred background of server racks in a data center.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/10/08_Cloud_cybersecurity_research_Overview_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) October 24, 2025 [#### Cloud Discovery With AzureHound](https://unit42.paloaltonetworks.com/threat-actor-misuse-of-azurehound/) * [Control plane](https://unit42.paloaltonetworks.com/tag/control-plane/ "control plane") * [Curious Serpens](https://unit42.paloaltonetworks.com/tag/curious-serpens/ "Curious Serpens") * [Data plane](https://unit42.paloaltonetworks.com/tag/data-plane/ "data plane") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/threat-actor-misuse-of-azurehound/ "Cloud Discovery With AzureHound") ![Pictorial representation of a gift card fraud campaign. A glowing skull and crossbones on a circuit board.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/10/07_Cybercrime_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) October 22, 2025 [#### Jingle Thief: Inside a Cloud-Based Gift Card Fraud Campaign](https://unit42.paloaltonetworks.com/cloud-based-gift-card-fraud-campaign/) * [CL‑CRI‑1032](https://unit42.paloaltonetworks.com/tag/cl-cri-1032/ "CL‑CRI‑1032") * [Microsoft](https://unit42.paloaltonetworks.com/tag/microsoft/ "Microsoft") * [Phishing](https://unit42.paloaltonetworks.com/tag/phishing/ "phishing") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/cloud-based-gift-card-fraud-campaign/ "Jingle Thief: Inside a Cloud-Based Gift Card Fraud Campaign") * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]() ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png) ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42 ## Peace of mind comes from staying ahead of threats. Subscribe today. Your Email Subscribe for email updates to all Unit 42 threat research. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement") This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. Invalid captcha! Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg) {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase) * [Prisma SASE](https://www.paloaltonetworks.com/sase) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Prisma Access](https://www.paloaltonetworks.com/sase/access) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42) * [Proactive Assessments](https://www.paloaltonetworks.com/unit42/assess) * [Incident Response](https://www.paloaltonetworks.com/unit42/respond) * [Transform Your Security Strategy](https://www.paloaltonetworks.com/unit42/transform) * [Discover Threat Intelligence](https://www.paloaltonetworks.com/unit42/threat-intelligence-partners) Company * [About Us](https://www.paloaltonetworks.com/about-us) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility) * [Customers](https://www.paloaltonetworks.com/customers) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/) * [Communities](https://www.paloaltonetworks.com/communities) * [Content Library](https://www.paloaltonetworks.com/resources) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure) * [Sitemap](https://www.paloaltonetworks.com/sitemap) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use) * [Documents](https://www.paloaltonetworks.com/legal) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ### Default Heading Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) Seekbar ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg) Volume ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)