A consultant agency needs to perform a security audit for a company's production AWS account. Several consultants need access to the account. The consultant agency already has its own AWS account…

Question

Options

• ACreate an IAM group. Create an IAM user for each consultant. Add each user to the group. Turn
• BConfigure Amazon Cognito on the company's production account to authenticate against the
• CCreate an IAM role in the consultant agency's AWS account. Define a trust policy that requires
• DCreate an IAM role in the company's production account. Define a trust policy that requires MFA.

• A
  14% (5)
• B
  3% (1)
• C
  5% (2)
• D
  78% (29)

Explanation

AWS best practices strongly discourage the use of long-term credentials and recommend cross- account IAM roles with temporary credentials for third-party access. According to the AWS Certified Security - Specialty Study Guide, creating an IAM role in the resource-owning account and allowing a trusted external AWS account to assume that role is the recommended pattern for external access. By creating the IAM role in the company's production account and specifying the consultant agency's AWS account as the trusted principal, the company retains full control over permissions. The trust policy can enforce MFA by using the aws:MultiFactorAuthPresent condition key, ensuring that all access requires MFA. Access is granted through AWS Security Token Service (STS), which issues short-lived credentials. Option A violates the requirement to avoid long-term credentials. Option B is designed for application user authentication, not AWS account access. Option C incorrectly places the role in the consultant's account, reducing the company's control over access. This solution satisfies MFA enforcement, eliminates long-term credentials, and aligns with AWS third- party access best practices.

No community discussion yet for this question.