Technical Concepts
The assessment IAM role
The single role created in your account: what it grants, what it denies, what it trusts, and when it stops working.
What it is
One IAM role, created by the CloudFormation stack you deploy, named per account.
What it attaches
Two AWS managed policies that are the scanner's documented baseline, four inline grants naming exactly the calls the collectors make, an expiry deny, and a data-plane deny.
What it trusts
A federated web identity only, with the audience and subject pinned, session names constrained to a govintel- prefix, and no session issuable after the engagement expiry.
It is not assumable by an IAM user, by another role, or by anyone holding a credential. A direct assume attempt from a non-federated principal is refused.
Why the name is fixed per account
Because that is what lets the role identifier be derived from twelve digits, which is the whole of the onboarding experience. IAM role names are scoped per account, so a fixed name cannot collide across customers.
What it cannot do
Create, modify or delete anything. Read data-plane content. Assume another role or pass one.
What it does not mean
Holding the role identifier grants nothing. It names a role; obtaining a session in it requires a token satisfying all four trust conditions.