IAM service role prevents confused deputy attacks

# IAM role trust policy with confused deputy protection
resource "aws_iam_role" "<example_resource_name>" {
  name = "<example_resource_name>"

  # CRITICAL: Condition restricts service to this account to prevent cross-service confused deputy
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect    = "Allow"
        Principal = { Service = "<service>.amazonaws.com" }
        Action    = "sts:AssumeRole"
        Condition = {
          StringEquals = { "aws:SourceAccount" = "<ACCOUNT_ID>" }
        }
      }
    ]
  })
}

# CloudFormation: IAM role trust policy with confused deputy protection
Resources:
  <example_resource_name>:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: <service>.amazonaws.com
            Action: sts:AssumeRole
            Condition:
              StringEquals:
                aws:SourceAccount: <ACCOUNT_ID>  # CRITICAL: restricts the service to calls from this account to prevent cross-service confused deputy