diff --git a/permissions/templates/cloudformation/prowler-scan-role.yml b/permissions/templates/cloudformation/prowler-scan-role.yml
index 83e599a60d..0fb6d69186 100644
--- a/permissions/templates/cloudformation/prowler-scan-role.yml
+++ b/permissions/templates/cloudformation/prowler-scan-role.yml
@@ -15,15 +15,25 @@ Description: |
 Parameters:
   ExternalId:
     Description: |
-      DO NOT CHANGE THIS.
       This is the External ID that Prowler will use to assume the role ProwlerScan IAM Role.
     Type: String
+    MinLength: 1
+    AllowedPattern: ".+"
+    ConstraintDescription: "ExternalId must not be empty."
   AccountId:
     Description: |
-      AWS Account ID that will assume the role created, if you are deploying this template to be used in Prowler Cloud
-      please use the default AWS Account ID.
+      AWS Account ID that will assume the role created, if you are deploying this template to be used in Prowler Cloud please do not edit this.
     Type: String
     Default: "232136659152"
+    MinLength: 12
+    MaxLength: 12
+    AllowedPattern: "[0-9]{12}"
+    ConstraintDescription: "AccountId must be a valid AWS Account ID."
+  IAMPrincipal:
+    Description: |
+      The IAM principal type and name that will be allowed to assume the role created, leave an * for all the IAM principals in your AWS account. If you are deploying this template to be used in Prowler Cloud please do not edit this.
+    Type: String
+    Default: role/prowler*
 
 Resources:
   ProwlerScan:
@@ -41,7 +51,7 @@ Resources:
               StringEquals:
                 "sts:ExternalId": !Sub ${ExternalId}
               StringLike:
-                "aws:PrincipalArn": !Sub "arn:${AWS::Partition}:iam::${AccountId}:role/prowler*"
+                "aws:PrincipalArn": !Sub "arn:${AWS::Partition}:iam::${AccountId}:${IAMPrincipal}"
       MaxSessionDuration: 3600
       ManagedPolicyArns:
         - "arn:aws:iam::aws:policy/SecurityAudit"
diff --git a/permissions/templates/terraform/main.tf b/permissions/templates/terraform/main.tf
index 9827755ae3..9213138b8b 100644
--- a/permissions/templates/terraform/main.tf
+++ b/permissions/templates/terraform/main.tf
@@ -2,13 +2,29 @@
 ###################################
 variable "external_id" {
   type        = string
-  description = "IAM Role External ID - Please input your External ID here below"
+  description = "This is the External ID that Prowler will use to assume the role ProwlerScan IAM Role."
+
+  validation {
+    condition     = length(var.external_id) > 0
+    error_message = "ExternalId must not be empty."
+  }
 }
 
 variable "account_id" {
   type        = string
-  description = "AWS Account ID that will assume the role created, if you are deploying this template to be used in Prowler Cloud please use the default AWS Account ID"
+  description = "AWS Account ID that will assume the role created, if you are deploying this template to be used in Prowler Cloud please do not edit this."
   default     = "232136659152"
+
+  validation {
+    condition     = length(var.account_id) == 12
+    error_message = "AccountId must be a valid AWS Account ID."
+  }
+}
+
+variable "iam_principal" {
+  type        = string
+  description = "The IAM principal type and name that will be allowed to assume the role created, leave an * for all the IAM principals in your AWS account. If you are deploying this template to be used in Prowler Cloud please do not edit this."
+  default     = "role/prowler*"
 }
 
 ##### PLEASE, DO NOT EDIT BELOW THIS LINE #####
@@ -61,7 +77,7 @@ data "aws_iam_policy_document" "prowler_assume_role_policy" {
       test     = "StringLike"
       variable = "aws:PrincipalArn"
       values = [
-        "arn:${data.aws_partition.current.partition}:iam::${var.account_id}:role/prowler*",
+        "arn:${data.aws_partition.current.partition}:iam::${var.account_id}:${var.iam_principal}",
       ]
     }
   }