What is the MOST secure way to allow org1 to access resources in org2?
The customer should provide the partner company with their AWS account access keys to log in and perform the required tasks.
The customer should create an IAM user and assign the required permissions to the IAM user. The customer should then provide the credentials to the partner company to log in and perform the required tasks.
The customer should create an IAM role and assign the required permissions to the IAM role. The partner company should then use the IAM role’s Amazon Resource Name (ARN) when requesting access to perform the required tasks.
The customer should create an IAM role and assign the required permissions to the IAM role. The partner company should then use the IAM role’s Amazon Resource Name (ARN), including the external ID in the IAM role’s trust policy, when requesting access to perform the required tasks.
Explanations:
Providing access keys compromises security as it exposes long-term credentials. This method lacks fine-grained permissions and does not allow for auditing or revoking access effectively.
While creating an IAM user with permissions is better than sharing access keys, it still provides long-term credentials that can be misused. This method does not promote least privilege or temporary access and requires credential management.
Creating an IAM role is a better practice as it allows for temporary credentials and more controlled access, but it does not include the use of an external ID, which adds an additional layer of security against the “confused deputy” problem.
This option promotes the most secure approach by using an IAM role with the least privilege permissions, and including an external ID in the trust policy mitigates the risk of unauthorized access by ensuring that only the intended party can assume the role. This method supports temporary credentials and allows for better auditing and control.