Exam AWS Certified Solutions Architect - Associate SAA-C03 topic 1 question 982 discussion

You can use AWS Identity and Access Management Roles Anywhere to obtain temporary security credentials in IAM for workloads such as servers, containers, and applications that run outside of AWS. Your workloads can use the same IAM policies and IAM roles that you use with AWS applications to access AWS resources. Using IAM Roles Anywhere means you don't need to manage long-term credentials for workloads running outside of AWS. https://docs.aws.amazon.com/rolesanywhere/latest/userguide/introduction.html

You have sensitive data in an S3 bucket, and an on-premises application needs temporary access. The solution must be secure and leverage IAM Identity Center (already in use), so now we need to grant temporary and secure credentials to the application while avoiding static credentials (like access keys). A - IP-based access lacks identity verification, leaving the bucket vulnerable to IP spoofing. B - This way you’re not introducing static credentials or deviating from your existing centralized identity setup. C - Manually managing credentials for multiple machines or applications is a hassle. D - Requires additional setup (Secrets Manager integration) and introduces ongoing costs. Also, the underlying issue (static credentials) is still there.

Answer is B. AM Roles Anywhere allows on-premises servers and applications to obtain temporary AWS credentials and access AWS resources securely. This solution allows your on-premises virtual machines to use IAM roles without needing long-term credentials (like access keys). The virtual machines can assume roles and access the S3 bucket temporarily and securely. Since the company is already using AWS IAM Identity Center, using IAM Roles Anywhere allows the company to leverage its existing Identity Center setup while following AWS best practices for security. This approach ensures the application can securely retrieve credentials without embedding static credentials into the application.

Answer is B