Security

This page describes the security model used by CCA Park Pass to access customer AWS accounts.

IAM Role Assumption

CCA Park Pass provisions an IAM role in the customer account via the CloudFormation template. The CCA AI Service assumes this role cross-account to perform its discovery process.

Read-only access

The IAM role assumed by the CCA AI Service is granted read-only permissions only. It cannot create, modify, or delete any resources in the customer account.

How it works

CCA AI Service (Blue Mantis account)
    └── sts:AssumeRole ──► Customer IAM Role (customer account)
                                └── Read-only policies

1. The CloudFormation template creates an IAM role in the customer account with a trust policy that allows the CCA AI Service principal to assume it.
2. The CCA AI Service calls sts:AssumeRole using the role ARN and an ExternalID set on the IAM role to obtain temporary credentials scoped to the customer account.
3. Those temporary credentials are used exclusively for read-only discovery operations.
4. Credentials are short-lived and automatically rotated by AWS STS — no long-lived keys are stored or transmitted.

External ID

The trust policy on the customer IAM role requires a matching ExternalID to be presented during role assumption. This is a defense against the confused deputy problem, preventing any other party from tricking the CCA AI Service into assuming a role in an unintended account.

Principle of Least Privilege

The IAM role created by the CloudFormation template follows the principle of least privilege:

• No write permissions — the role cannot create, update, or delete resources.
• No IAM privilege escalation — the role cannot create or modify IAM roles or policies.
• Scoped to required services — permissions are restricted to only the AWS services needed for the CCA discovery process.

Responsibility

Responsibility	Owner
Read-only scope of the assumed role	Blue Mantis (enforced by CloudFormation template)
CCA AI Service credential handling	Blue Mantis