diff --git a/moto/iam/policy_validation.py b/moto/iam/policy_validation.py index 316ef9ee5..0b51c1011 100644 --- a/moto/iam/policy_validation.py +++ b/moto/iam/policy_validation.py @@ -557,9 +557,17 @@ class IAMTrustPolicyDocumentValidator(BaseIAMPolicyValidator): @staticmethod def _validate_trust_policy_action(action): + # https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssecuritytokenservice.html assert action in ( "sts:AssumeRole", "sts:AssumeRoleWithSAML", "sts:AssumeRoleWithWebIdentity", + "sts:DecodeAuthorizationMessage", + "sts:GetAccessKeyInfo", + "sts:GetCallerIdentity", + "sts:GetFederationToken", + "sts:GetServiceBearerToken", + "sts:GetSessionToken", + "sts:SetSourceIdentity", "sts:TagSession", )