SCS-C02 Question 282
Single answerAn organization wants to provide its developers the ability to assume an IAM Role to access an S3 bucket in another AWS account. The security team requires that access be granted only through a secure and auditable method. How should the organization configure authentication to meet this requirement?
- A
Create an IAM Role in the target account with a trust policy allowing the source account, and use AWS STS AssumeRole API to obtain temporary credentials.
- B
Create an IAM user in the target account, share the access key and secret key with developers, and apply an S3 bucket policy to allow access.
- C
Use the access keys of an IAM user from the target account and hardcode them into the application used by the developers.
- D
Enable S3 cross-account access by attaching a bucket policy that explicitly allows access from the source account without additional authentication.
Show answer and explanation
Correct answer: A
Explanation
To securely provide cross-account access, AWS recommends using IAM Roles with a trust policy and the AWS Security Token Service (STS) for temporary credentials. This method ensures that access is granted securely, with the ability to audit actions performed using the role. Sharing or hardcoding credentials is strongly discouraged due to security and operational risks.
- A. Correct.
This is the correct option because using the AWS STS AssumeRole API with an IAM Role and trust policy ensures secure, temporary, and auditable access to resources in the target account.
- B. Incorrect.
This is incorrect because sharing IAM user access keys is insecure and does not meet the requirement for auditability or best practices for authentication.
- C. Incorrect.
This is incorrect because hardcoding access keys is a poor security practice and poses significant risks, such as accidental exposure or lack of auditability.
- D. Incorrect.
This is incorrect because allowing cross-account access via a bucket policy alone does not enforce authentication mechanisms and bypasses the security requirements.