Which solution will meet these requirements MOST securely?
Create an IAM role in the company’s account to delegate access to the vendor’s IAM role. Attach the appropriate IAM policies to the role for the permissions that the vendor requires.
Create an IAM user in the company’s account with a password that meets the password complexity requirements. Attach the appropriate IAM policies to the user for the permissions that the vendor requires.
Create an IAM group in the company’s account. Add the automated tool’s IAM user from the vendor account to the group. Attach the appropriate IAM policies to the group for the permissions that the vendor requires.
Create an IAM user in the company’s account that has a permission boundary that allows the vendor’s account. Attach the appropriate IAM policies to the user for the permissions that the vendor requires.
Explanations:
This option involves creating an IAM role in the company’s account that the vendor can assume. This is a secure method because it follows the principle of least privilege and allows for controlled access without creating long-lived credentials. The vendor’s IAM role can be granted specific permissions, and the access can be easily revoked when it’s no longer needed.
Creating an IAM user for the vendor with a password does not follow the best practices for temporary access and is less secure. IAM users have long-term credentials, which can pose security risks. If the vendor no longer needs access, the user must be manually deleted, and managing the credentials can lead to potential security vulnerabilities.
Adding the vendor’s IAM user to an IAM group in the company’s account does not apply because the vendor does not have IAM access to the company’s account. Moreover, it would create a dependency on the vendor’s account structure, which could lead to security issues and management challenges. This method also lacks the principle of least privilege, as it allows broader access than necessary.
Creating an IAM user with a permission boundary that allows the vendor’s account is not ideal because it still creates long-term credentials for the vendor. While permission boundaries can limit what the user can do, it does not align with the best practice of using roles for temporary access. If access needs to be changed, the user must be updated or deleted manually, which can lead to complications.
My best guess is:
Create an IAM role in the company’s account to delegate access to the vendor’s IAM role. Attach the appropriate IAM policies to the role for the permissions that the vendor requires.
To the best of my knowledge, the answer is:
Create an IAM role in the company’s account to delegate access to the vendor’s IAM role. Attach the appropriate IAM policies to the role for the permissions that the vendor requires.