IAM Role Trust Relationship Generator

A trust policy decides who is allowed to assume an IAM role — it grants no AWS permissions on its own. IAM Role Trust Relationship Generator builds that statement for five principal shapes in one form: an AWS account (root), a specific IAM role or user ARN, an AWS service principal, a Federated SAML or OIDC identity provider, and — with a strong warning — the anonymous "*" principal that some genuinely public or heavily-conditioned trust relationships require.

Federated principals get real branching, not a cosmetic label: choosing SAML sets the action to sts:AssumeRoleWithSAML, choosing OIDC sets it to sts:AssumeRoleWithWebIdentity, and an optional audience value builds the <provider-host>:aud condition AWS recommends for Web Identity federation so a role trusting an OIDC provider is not left open to tokens issued for any audience. Every other principal type uses the standard sts:AssumeRole.

Two more optional conditions cover the hardening patterns that come up in almost every real cross-account or public-ish trust relationship: an External ID (sts:ExternalId) as the standard confused-deputy mitigation, and a Require MFA switch (aws:MultiFactorAuthPresent). All conditions this tool builds merge into one Condition block.

The "*" anonymous option exists because it is a real trust-policy shape — some setups (a role meant to be assumable cross-organization behind a strict External ID, for instance) legitimately use it — but it is also the single easiest way to accidentally expose a role to the entire internet, so it is never presented without an on-page warning, and pairing it with a hard-to-guess External ID is called out explicitly.

As with the rest of this tool suite, the shared statement builder defaults every statement to Resource: "*"; because trust policies use Principal in place of Resource, this generator explicitly strips that field so the copied JSON never carries a stray Resource key. Validation is structural only — Version, Statement, Effect, Action, and Principal presence — never a live AWS check, and every value you type stays in your browser.

• Five principal types — AWS account (root), specific role/user ARN, AWS service, Federated (SAML/OIDC), and anonymous "*" with a strong warning.
• Real action branching for SAML vs OIDC federation.
• Optional OIDC audience condition, derived from the provider ARN automatically.
• Optional External ID and Require MFA conditions, mergeable together.
• Resource field correctly omitted — the tool actively strips the shared builder's default.
• Structural validation and a copyable/downloadable JSON document.
• 100% client-side.

1. Pick a principal type.
2. Fill in the value for that type.
3. For Federated, choose SAML or OIDC and optionally set an audience.
4. Optionally set External ID and/or Require MFA.
5. Click Build trust policy.
6. Copy or download the resulting JSON and review it before attaching it as the role's trust relationship.

Example 1 — EC2 instance role. Principal type AWS service, value ec2.amazonaws.com.

Example 2 — GitHub Actions OIDC. Principal type Federated/OIDC, provider ARN for token.actions.githubusercontent.com, audience sts.amazonaws.com — produces the recommended :aud condition automatically.

Example 3 — cross-account with External ID. Principal type AWS account, External ID set — the standard confused-deputy shape.

Example 4 — anonymous with warning. Principal type "*", paired with a hard-to-guess External ID — the tool flags this combination as high-risk on screen.

• Covers the full range of real trust-policy principal shapes in one tool, including federation.
• OIDC audience condition built automatically from the provider ARN.
• Honest about the risk of the "*" principal rather than hiding it.
• Structural validation before you attach the policy.
• Private — nothing you type leaves your browser.