Detects a successful AWS IAM CreateRole event where the role’s trust policy allows sts:AssumeRole by principals outside the same account or by a wildcard. The rule relies on AWS CloudTrail data (CloudTrail logging for iam.amazonaws.com CreateRole) to identify when a role is created with a potentially risky trust relationship. It first filters for successful CreateRole events (no errorCode or errorCode indicates success). It then extracts the trust policy document (requestParameters.assumeRolePolicyDocument), the role name, and the role ARN, along with the user identity and source IP. The policy is decoded if URL-encoded and parsed to enumerate trust statements. For each statement with Effect: Allow, it inspects Action to confirm the presence of sts:AssumeRole and extracts the Principal (AWS). Principals are normalized to account IDs where possible. The rule flags two risk patterns: a wildcard trust (*) and a cross-account trust (trust principal account differs from the role’s account). If either condition is met, the event is marked as a potential external trust that could enable persistence if the principal can assume the role. The rule deduplicates results by event key and trust principal, and outputs a table with time, eventID, user identity, source IP, role name, role ARN, role account, trust type, trust principal, principal account, and the specific trust action. A finding is generated to surface: “The AWS IAM role [role_name] created with [trust_type] trust.” The rule emphasizes that role creation with external or wildcard trust does not by itself prove misuse and should be supplemented with owner validation, legitimate cross-account use, and role permission review. It is designed to work with Splunk’s AWS Add-on and CloudTrail logs. Thematic alignment includes AWS IAM Privilege Escalation and cross-account persistence (MITRE ATT&CK T1098.003).