docs(aws-iam): add SourceAccount guidance for service principals

- Document aws:SourceAccount/aws:SourceArn conditions for cross-service confused deputy prevention
- Add skill reference page for cross-service confused deputy pattern

Author: d-padmanabhan

rules/412-aws-iam.mdc

@@ -190,6 +190,43 @@ If a vendor assumes a role in your account, require an `ExternalId` and lock to
 > [!NOTE]
 > Use `ExternalId` when you are protecting against the **confused deputy** problem (common in SaaS integrations).
 
+#### Cross-service confused deputy prevention (resource policies): `aws:SourceAccount` / `aws:SourceArn`
+
+When a **resource-based policy** grants access to an **AWS service principal** (for example,
+`cloudtrail.amazonaws.com`, `events.amazonaws.com`, `sns.amazonaws.com`), the policy is trusting the
+service principal — not the human/role that configured the calling service.
+
+To reduce confused-deputy risk, restrict the service principal with global condition keys:
+
+- `aws:SourceAccount` (allow only when acting on behalf of a specific AWS account)
+- `aws:SourceArn` (allow only when acting on behalf of a specific AWS resource ARN)
+
+AWS guidance: `https://docs.aws.amazon.com/IAM/latest/UserGuide/confused-deputy.html`
+
+Example (CloudTrail writing to S3; restrict by source account):
+
+```json
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Sid": "CloudTrailAclCheck",
+      "Effect": "Allow",
+      "Principal": { "Service": "cloudtrail.amazonaws.com" },
+      "Action": "s3:GetBucketAcl",
+      "Resource": "arn:aws:s3:::amzn-s3-demo-bucket1",
+      "Condition": {
+        "StringEquals": { "aws:SourceAccount": "111122223333" }
+      }
+    }
+  ]
+}
+```
+
+> [!IMPORTANT]
+> Prefer **both** `aws:SourceAccount` and `aws:SourceArn` where supported by the calling service.
+> Check the specific service’s docs for supported keys.
+
 ## Identity-based vs resource-based policies (quick rules)
 
 - **Identity-based** policies generally do **not** specify `Principal` (it's implicit: the attached user/role)

skills/aws-iam/SKILL.md

@@ -38,5 +38,6 @@ Use this skill when you are working on:
 
 - `references/iam-authorization-model.md`
 - `references/cross-account-and-externalid.md`
+- `references/cross-service-confused-deputy.md`
 - `references/kms-key-policy-and-grants.md`
 - `references/eks-pod-identity-abac-and-lattice.md`

skills/aws-iam/references/cross-service-confused-deputy.md

@@ -0,0 +1,69 @@
+# Cross-service confused deputy prevention (`aws:SourceAccount`, `aws:SourceArn`)
+
+When a **resource-based policy** grants access to an **AWS service principal** (for example,
+`cloudtrail.amazonaws.com`, `events.amazonaws.com`, `sns.amazonaws.com`), the policy authorizes the
+service principal — not the actor that configured the calling service.
+
+If the policy is missing constraints, an unauthorized actor can sometimes abuse that trust relationship
+(the **confused deputy** problem).
+
+## Recommended pattern
+
+- **Always add conditions** when granting access to an AWS service principal in a resource policy
+- Prefer using **both**:
+  - `aws:SourceAccount` to scope the caller to an expected AWS account
+  - `aws:SourceArn` to scope the caller to an expected AWS resource ARN
+- Where appropriate (org-wide guardrails), consider:
+  - `aws:SourceOrgID`
+  - `aws:SourceOrgPaths`
+
+## Example: S3 bucket policy for CloudTrail (scope by source account)
+
+```json
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Sid": "CloudTrailAclCheck",
+      "Effect": "Allow",
+      "Principal": { "Service": "cloudtrail.amazonaws.com" },
+      "Action": "s3:GetBucketAcl",
+      "Resource": "arn:aws:s3:::amzn-s3-demo-bucket1",
+      "Condition": {
+        "StringEquals": { "aws:SourceAccount": "111122223333" }
+      }
+    }
+  ]
+}
+```
+
+## Example: S3 bucket policy for an AWS service (scope by source ARN)
+
+```json
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Principal": { "Service": "appstream.amazonaws.com" },
+      "Action": "s3:GetObject",
+      "Resource": "arn:aws:s3:::amzn-s3-demo-bucket2/examplefile.psh",
+      "Condition": {
+        "ArnEquals": {
+          "aws:SourceArn": "arn:aws:appstream:us-east-1:111122223333:fleet/ExampleFleetName"
+        }
+      }
+    }
+  ]
+}
+```
+
+## Notes
+
+- Not every AWS service supports every key in every integration. Use the service docs as source of truth.
+- For KMS specifically, key policies/grants often have additional service-specific controls.
+
+## References
+
+- Confused deputy (cross-account + cross-service): `https://docs.aws.amazon.com/IAM/latest/UserGuide/confused-deputy.html`
+- Global condition keys (including `aws:SourceAccount`, `aws:SourceArn`): `https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html`