I have an SSO role that I want to deploy to many of my accounts within my AWS Organization, and I cant customise each role policy for each account.
I want to restrict the user in the role from using the Action sts:AssumeRole where the Account ID is different from the current one.
The closest I could get to finding a solution here might be using the condition keys for aws:SourceAccount, and aws:PrincipalAccount. I just dont know how I could stitch that together in a policy doc properly, or if what I want to do is even possible