Question 100
An architecture review recommends this solution: Require tightly scoped role trust and a scoped session policy or condition that limits the assumed-role credentials. The motivating situation is: A vendor assumes a role into an AWS account and must be restricted to one project's S3 prefix for that session only. Which architectural reasoning is most accurate for the choice?
Explanation
Correct Answer
This principle explains why the prescribed control is appropriate for the described requirement. The matching design action is: Require tightly scoped role trust and a scoped session policy or condition that limits the assumed-role credentials. The expected supporting evidence is: The assumed session can read the approved prefix and is denied a separate confidential prefix.
Incorrect Answers
No archive or retention mechanism was configured before the subscriber outage. The stated evidence instead indicates: An overly broad assumed-role session is not constrained to the vendor's assigned resources.
Disjoint local-account trails leave central auditors with incomplete visibility. The stated evidence instead indicates: An overly broad assumed-role session is not constrained to the vendor's assigned resources.
Individual IAM users were being created per account instead of using centralized workforce federation. The stated evidence instead indicates: An overly broad assumed-role session is not constrained to the vendor's assigned resources.