A deep dive into Temporal's access control strategy in AWS

What this post added

This post details an in-depth investigation into AWS SCPs and their practical application for implementing a Biba-style access control model. It highlights a critical misunderstanding of how SCPs interact with the `sts:AssumeRole` API, demonstrating that SCPs do not prevent the issuance of credentials for cross-account role assumption, even when an SCP denies all actions. The post also discusses the limitations of SCPs in managing trust relationships with external accounts and vendors, and the operational overhead involved in manually updating Assume Role Policy Documents.