SAA-C03 Q669 · IAM

Question

A company has hired an external vendor to work in the company's AWS account. The vendor uses an automated tool that the vendor hosts in its own AWS account. The vendor does not have IAM access to the company's AWS account. A solutions architect needs to grant access to the vendor. Which solution will meet these requirements MOST securely?

Accepted Answer

**Answer A: Create an IAM role in the company's account to delegate access to the vendor's IAM role.**

This is the standard AWS pattern for **cross-account access** and satisfies every requirement:

1. **No IAM user credentials shared**: Instead of creating long-lived credentials (username/password or access keys), a role is assumed temporarily. The vendor's automated tool uses **STS AssumeRole** to get temporary security credentials.

2. **Principle of least privilege**: The IAM role in the company's account has only the specific policies the vendor needs. The trust policy on the role explicitly specifies the vendor's AWS account (and optionally the vendor's specific IAM role ARN) as the trusted principal.

3. **Most secure approach**: Temporary credentials from STS automatically expire

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

🔒 Security

🎯 Exam Tips