DVA-C02 · Question #363
A developer needs temporary access to resources in a second account. What is the MOST secure way to achieve this?
The correct answer is C. Create a cross-account access role, and use sts:AssumeRole API to get short-lived credentials. Cross-account temporary access is best achieved with an IAM cross-account role and STS AssumeRole, which issues short-lived credentials scoped to only the permissions defined in that role.
Question
A developer needs temporary access to resources in a second account. What is the MOST secure way to achieve this?
Options
- AUse the Amazon Cognito user pools to get short-lived credentials for the second account.
- BCreate a dedicated IAM access key for the second account, and send it by mail.
- CCreate a cross-account access role, and use sts:AssumeRole API to get short-lived credentials.
- DEstablish trust, and add an SSH key for the second account to the IAM user.
How the community answered
(38 responses)- B5% (2)
- C92% (35)
- D3% (1)
Why each option
Cross-account temporary access is best achieved with an IAM cross-account role and STS AssumeRole, which issues short-lived credentials scoped to only the permissions defined in that role.
Amazon Cognito user pools authenticate end users (humans) for application-level identity and are not designed to grant AWS service-to-service access between accounts.
Creating a dedicated IAM access key produces long-lived credentials that must be rotated manually; transmitting them via email is a critical security vulnerability and violates AWS security best practices.
Creating a cross-account IAM role with a trust policy that allows the source account to call sts:AssumeRole issues time-limited credentials (default 1 hour, max 12 hours) without creating long-lived access keys, follows the principle of least privilege, and provides a full audit trail in AWS CloudTrail.
SSH keys in IAM are used for authenticated Git access to AWS CodeCommit and cannot be used to obtain AWS API credentials or access resources in another account.
Concept tested: Cross-account IAM role assumption for temporary credentials
Source: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_common-scenarios_aws-accounts.html
Community Discussion
No community discussion yet for this question.