Exam AWS Certified Security - Specialty SCS-C02 topic 1 question 248 discussion

D - Create the role for production accoint which is required MFA from consultant account.

Security: By creating an IAM role in the company's production account, the consultants will only have temporary access to the specific resources granted by the role. This limits the potential damage if credentials are compromised. MFA Enforcement: The trust policy can be configured to require MFA for all access to the role, ensuring that consultants are authenticated with a strong second factor. No Long-Term Credentials: The consultants will not need long-term access keys, as they will use temporary credentials generated by their AWS account. Granular Access Control: The IAM role can be configured with specific permissions to limit access to only the necessary resources, reducing the risk of unauthorized actions. This approach provides a secure, flexible, and compliant solution for granting temporary access to the consultant agency while enforcing strong security measures.