SAP-C02 Q149 · IAM

Question

A company is subject to regulatory audits of its financial information. External auditors who use a single AWS account need access to the company's AWS account. A solutions architect must provide the auditors with secure, read-only access to the company's AWS account. The solution must comply with AWS security best practices. Which solution will meet these requirements?

Accepted Answer

Option B is correct because it follows the AWS-recommended pattern for granting cross-account access to third parties:

1. **Cross-account IAM Role**: Instead of creating IAM users (which requires sharing long-term credentials), an IAM role is created in the company's account that trusts the auditors' AWS account. This enables the auditors to **assume the role** using temporary credentials via AWS STS.

2. **Trust Policy with External ID**: The role's trust policy specifies the auditors' AWS account as a trusted principal. The **external ID** is a unique secret shared between the company and the auditor. It solves the **confused deputy problem** — without it, any AWS customer who knows the company's account ID and role ARN could potentially assume the role. The external ID ensures only the

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

🔒 Security

🎯 Exam Tips