AWS transcribe: Add confused-deputy-safe trust policy example for Transcribe DataAccessRoleArn

Service: transcribe · 2026-10-06 · Documentation medium

File: transcribe/latest/dg/security_iam_id-based-policy-examples.md · Type: iam

Summary

Adds guidance that the role in DataAccessRoleArn must trust transcribe.amazonaws.com (and transcribe.streaming.amazonaws.com for streaming requests using customer-managed keys), with an example trust policy that includes aws:SourceAccount and aws:SourceArn conditions.

Security assessment

The added example demonstrates IAM role trust boundaries and includes confused-deputy mitigations (aws:SourceAccount and aws:SourceArn conditions), which are authorization-relevant security best practices even though no specific CVE is cited.

Evidence

+The role you specify in `DataAccessRoleArn` must also have a trust policy that allows Amazon Transcribe to assume it. Use `transcribe.amazonaws.com` for batch transcription. If your streaming request uses a customer-managed key to encrypt a custom vocabulary, custom vocabulary filter, or custom language model, the role must also trust `transcribe.streaming.amazonaws.com`. The following is an example trust policy that allows both.

Diff

diff --git a/transcribe/latest/dg/security_iam_id-based-policy-examples.md b/transcribe/latest/dg/security_iam_id-based-policy-examples.md
index 9ac47ab..ce2284d 100644
--- a//transcribe/latest/dg/security_iam_id-based-policy-examples.md
+++ b//transcribe/latest/dg/security_iam_id-based-policy-examples.md
@@ -295,0 +296,36 @@ JSON
+The role you specify in `DataAccessRoleArn` must also have a trust policy that allows Amazon Transcribe to assume it. Use `transcribe.amazonaws.com` for batch transcription. If your streaming request uses a customer-managed key to encrypt a custom vocabulary, custom vocabulary filter, or custom language model, the role must also trust `transcribe.streaming.amazonaws.com`. The following is an example trust policy that allows both.
+
+JSON
+    
+
+****
+    
+    
+    
+    {
+      "Version":"2012-10-17",
+      "Statement": [
+        {
+          "Effect": "Allow",
+          "Principal": {
+            "Service": [
+              "transcribe.amazonaws.com",
+              "transcribe.streaming.amazonaws.com"
+            ]
+          },
+          "Action": [
+            "sts:AssumeRole"
+          ],
+          "Condition": {
+            "StringEquals": {
+              "aws:SourceAccount": "111122223333"
+            },
+            "ArnLike": {
+              "aws:SourceArn": "arn:aws:transcribe:us-west-2:111122223333:*"
+            }
+          }
+        }
+      ]
+    }
+    
+