Examkin

Question

Difficulty: HardIdentity and Access Management (IAM)

A company needs to grant programmatic access to an external third-party Software-as-a-Service (SaaS) monitoring tool to read configuration metrics from their AWS account. The SaaS tool does not run on AWS infrastructure. According to AWS Identity and Access Management (IAM) best practices, which configuration should the administrator implement to grant this access?

  1. Configure a cross-account IAM role with a trust policy that allows the third-party AWS account to assume the role, requiring an external ID.Answer
  2. B
    Create a dedicated IAM user, generate programmatic access keys, and share these keys with the third-party tool.
  3. C
    Provide the third-party tool with the access keys of the AWS Account Root User to ensure uninterrupted programmatic API access.
  4. D
    Request that the AWS customer support team configure the third-party tool's access permissions directly within the AWS infrastructure.

Answer

Configure a cross-account IAM role with a trust policy that allows the third-party AWS account to assume the role, requiring an external ID.
The correct option outlines the standard AWS security recommendation for granting third-party access. By configuring a cross-account IAM role, the third-party tool can obtain temporary security credentials to perform API actions. Requiring an external ID is a vital security best practice that prevents the 'confused deputy' problem in multi-tenant integrations.

Step-by-Step Solution

1
Analyze the access requirement for an external SaaS tool that does not run on AWS infrastructure.
The tool requires programmatic access to AWS APIs from outside the company's AWS environment.
Understanding the caller's origin is necessary to choose between identity federation, IAM users, or cross-account roles.
2
Evaluate the credentials policy for third-party access.
Using temporary credentials via IAM roles is identified as the secure, recommended method instead of sharing static, long-term access keys.
IAM roles allow the external entity to assume permissions dynamically, eliminating the need to store and rotate permanent access keys.
3
Define the relationship using a cross-account role with an external ID.
A trust relationship is configured between the customer account and the SaaS provider account, utilizing an external ID to mitigate the confused deputy vulnerability.
This establishes secure delegation of access specifically tailored for multi-tenant third-party SaaS integrations.

Key Concept

Cross-account IAM delegation and external ID best practices for third-party integrations
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic