Stop the confused deputy

A monitoring vendor works inside your account by assuming a role you created for it. You handed over the role ARN when the integration was set up, and that is all the vendor needs to make the call.

Open the External ID console. Three AssumeRole calls reached your role this hour, every one of them from the vendor. Read the bottom card and compare what the vendor did on each.

Two of those three reads were asked for by somebody else. Tick the sts:ExternalId requirement and watch both of them stop.

Why can another of the vendor's customers not simply send your value too?