Question 710
An architecture review recommends this solution: Configure IAM role federation with OIDC trust subject restrictions for the external build identity. The motivating situation is: A build system hosted outside AWS needs temporary access to deploy CloudFormation without storing long-lived access keys. Which consideration makes this solution preferable to the original approach?
Explanation
Correct Answer
This principle explains why the prescribed control is appropriate for the described requirement. The matching design action is: Configure IAM role federation with OIDC trust subject restrictions for the external build identity. The expected supporting evidence is: The approved CI workload receives short-lived role credentials and an unapproved repository identity fails assumption.
Incorrect Answers
The shared file system's throughput mode or credit availability constrains parallel clients. The stated evidence instead indicates: Static IAM user access keys were embedded in the external CI configuration.
Raw CloudTrail logs were collected but no managed threat-detection findings were enabled. The stated evidence instead indicates: Static IAM user access keys were embedded in the external CI configuration.
A public bucket policy exposes origin objects outside the intended CloudFront access path. The stated evidence instead indicates: Static IAM user access keys were embedded in the external CI configuration.