A confused deputy attack occurs when an attacker gets a more-privileged program or service to misuse its legitimate access on the attacker’s behalf. The key failure is that the intermediary acts without correctly preserving or checking who initiated the request, which customer it belongs to, or which resource and action were intended.
What is a confused deputy attack?
A confused deputy is a privileged intermediary—a program, service, or other component—that is tricked into using its authority for someone who does not have that authority. The attacker may not be able to reach the protected resource directly; instead, the attacker persuades a trusted deputy to make a request that appears to come from the deputy.
As an Amazon Associate I earn from qualifying purchases.
AWS defines the problem as one in which “an entity that doesn’t have permission to perform an action can coerce a more-privileged entity to perform the action.” (AWS IAM User Guide: The confused deputy problem.) MITRE describes a related proxy failure: a component forwards an upstream request without preserving its original source, making the proxy appear to be the requester. MITRE classifies this weakness as CWE-441, “Unintended Proxy or Intermediary (‘Confused Deputy’).” (MITRE CWE-441.)
Recommended Free Tools
A proxy or delegated service is not automatically vulnerable. The risk arises when the deputy has access the caller lacks, the caller can induce a request the deputy did not intend to make, and the deputy fails to bind that request to its origin and intended target.
#1 Best Overall
How does the attack work?
- A privileged deputy can access a resource or perform an operation.
- A less-privileged caller supplies or manipulates a request, identifier, target, or customer context.
- The deputy acts using its own authority without correctly validating the caller’s identity and intended target or action.
- The target sees the deputy’s legitimate identity, so the request may pass checks that would have denied the original caller.
This is an authorization and identity-context failure: authenticating the deputy does not, by itself, prove that the original caller may use the deputy’s privileges for this request.
How does this happen in AWS?
AWS documents two patterns that cross different trust boundaries. The first concerns a third party assuming a customer’s role; the second concerns an AWS service principal accessing a resource such as an S3 bucket. They require different controls.
| Pattern | Who acts as the deputy? | Context to bind | Where the control belongs |
|---|---|---|---|
| Third-party cross-account delegation | A multi-tenant third-party service | The intended customer | The IAM role’s trust policy |
| Cross-service resource access | An AWS service principal | The intended source resource, account, or organization | The resource-based policy |
Third-party cross-account role assumption
A customer may give a third-party service the ARN of an IAM role so the service can assume that role and access the customer’s AWS resources. If the service handles multiple customers and does not bind each role assumption to the correct customer, one customer could induce it to use another customer’s role ARN. The ARN identifies the role; it is not a secret, so obscuring it does not prevent the attack.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
AWS’s external ID pattern addresses this customer-context mix-up. The third-party service generates and controls a unique external ID for each customer, and the role trust policy requires the matching value when the service calls AssumeRole. The check ties the assumption to the intended customer context. An external ID is not a password or a replacement for least-privilege permissions and a correctly scoped trust relationship. See AWS’s guidance on the confused deputy problem.
Rank #3
AWS service principal accessing a resource
In AWS’s CloudTrail and S3 example, a bucket policy trusts the CloudTrail service principal but does not restrict which account or resource may configure the service to write there. Someone who knows the bucket name could configure CloudTrail to deliver logs to it. The bucket sees a trusted service principal, but that identity alone does not establish which source account or resource initiated the access.
AWS recommends adding supported source-context conditions to resource policies when granting access to an AWS service principal. Depending on the integration, relevant keys include aws:SourceArn, aws:SourceAccount, aws:SourceOrgID, and aws:SourceOrgPaths. Use a specific source ARN when the intended resource is known; account or organization conditions can express broader scope. Check the service-specific documentation because support for these keys varies. See AWS’s confused deputy guidance.
How can you prevent a confused deputy attack?
- Preserve the initiator’s identity. Carry the original caller’s identity through intermediary hops instead of replacing it with only the deputy’s identity. MITRE recommends keeping the initiator identity immutable and forwarding it to the target (CWE-441).
- Authenticate both parties. When a request passes through an intermediary, establish the identity of both the intermediary and the original initiator.
- Bind each request to its intended context. Validate the customer, source resource, requested operation, and target. Do not treat successful authentication of the deputy as proof that the original caller is entitled to its authority.
- Use an external ID for third-party role delegation. Require the third-party-generated, customer-specific value in the role trust policy so role assumption is tied to the correct customer context.
- Constrain AWS service-principal access. Add applicable source ARN, account, or organization conditions to the resource policy, selecting keys the specific service integration supports.
- Limit permissions. Give the deputy only the access it needs. Least privilege reduces what can be misused, though it does not replace identity and context checks.
Is a confused deputy attack the same as SSRF?
No. Server-Side Request Forgery (SSRF), tracked as CWE-918, is a related but narrower case in which an attacker induces a server to make requests the attacker cannot make directly. MITRE lists SSRF as a child entry of CWE-441 because some SSRF flaws involve an intermediary being misused as a proxy. Not every confused deputy attack is SSRF, and the terms are not interchangeable (MITRE CWE-441).
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesQuick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
