confused deputy

term

cloudsecurity

A privileged service tricked into using its authority on behalf of an unauthorized caller - the deputy is honest, just confused about who is asking.

Cross-account role assumption grew external IDs specifically to break this attack.

All glossary entries