Exam AWS Certified Solutions Architect - Professional SAP-C02 topic 1 question 126 discussion

D Well.. "external ID" is the keyword that you should look for in such scenario.

D. The customer should create an IAM role and assign the required permissions to the IAM role. The partner company should then use the IAM role’s Amazon Resource Name (ARN), including the external ID in the IAM role’s trust policy, when requesting access to perform the required tasks. A - that is just hilarious and should not be the case.

D. The customer should create an IAM role and assign the required permissions to the IAM role. The partner company should then use the IAM role’s Amazon Resource Name (ARN), including the external ID in the IAM role’s trust policy, when requesting access to perform the required tasks.

Option D is most secure.

Sharing credentials will always be a bad idea. In comparison to C and D, options A and B are insecure. The reason D is the most secure option compared to C is because it addresses the confused deputy problem - https://docs.aws.amazon.com/IAM/latest/UserGuide/confused-deputy.html

it's D, but private link would be a better choice

With the external ID.

{ "Version": "2012-10-17", "Statement": { "Effect": "Allow", "Principal": { "AWS": "Example Corp's AWS Account ID" }, "Action": "sts:AssumeRole", "Condition": { "StringEquals": { "sts:ExternalId": "1122334455-The ID that only Third party and customer knows" } } } }

Easy. The external ID is for sure the winner.

D seems the correct answer

https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_common-scenarios_third-party.html

The correct answer is D. This is the most secure way to allow org1 to access resources in org2 because it allows for least privilege security access. The customer should create an IAM role and assign the required permissions to the IAM role. The partner company should then use the IAM role’s Amazon Resource Name (ARN) and include the external ID in the IAM role’s trust policy when requesting access to perform the required tasks. This ensures that the partner company can only access the resources that it needs and only from the specific customer account. Option A and B both involve providing the partner company with credentials, which can be easily compromised and could lead to a security breach. Option C also provides the partner company with an IAM role, but it doesn't have any restrictions on when and where the partner company can access the resources in customer account, it could be a security risk.

D is correct