When a role trust policy or a resource policy names an AWS service principal such as s3.amazonaws.com or events.amazonaws.com, the service will assume the role on behalf of whatever resource triggers it, and without a condition that resource can belong to someone else's account. This is the confused deputy problem, and it applies to S3 bucket notifications, EventBridge rules, SNS, CloudWatch Logs delivery, and Lambda resource policies.
Constrain it with aws:SourceAccount set to your account id and aws:SourceArn set to the specific bucket, rule or topic. Use ArnLike when the source ARN needs a wildcard segment. For Lambda, aws lambda add-permission --source-arn writes exactly this condition.
One caution: not every service populates aws:SourceArn, and a condition on a key the service never sends denies every call, because a positive operator with a missing key evaluates false. Check the specific service's documentation before adding it, and prefer aws:SourceAccount when unsure.