Exam AWS Certified Solutions Architect - Associate SAA-C03 topic 1 question 503 discussion

By having customers create an IAM role with the necessary permissions in their own accounts, the company can use AWS Identity and Access Management (IAM) to establish cross-account access. The trust policy allows the company's AWS account to assume the customer's IAM role temporarily, granting access to the specified resources (EC2 instances and CloudWatch metrics) within the customer's account. This approach follows the principle of least privilege, as the company only requests the necessary permissions and does not require long-term access keys or user credentials from the customers.

A. Roles give temporary credentials

B: Sharing credentials, even temporary, is insecure C: Access and secret keys. That won't work and sharing secrets outside of account is not secure for this use case A: Keyword "trust policy" D: Again, sharing username and pwd and sharing in any way is not secure

Not B (would be about access to the company's account, not the customers' accounts) Not C (storing credentials in a custom system is a big nono) Not D (Cognito has nothing to do here and "user and password" is terrible)

The company's infrastructure monitoring service needs to call aws API's in the MOST secure way. So you have to focus on restricting access to the APIs and there is where cognito comes in to play.

A is the most secure approach for accessing customer accounts. Having customers create a cross-account IAM role with the appropriate permissions, and configuring the trust policy to allow the monitoring service principal account access, implements secure delegation and least privilege access.