An external operations team needs limited access to one AWS account for a short task.
Long-term personal access keys must not be shared.
Which approach is appropriate?
A role in the target account with a trust policy can be assumed by an approved principal and provide temporary, scoped credentials.
Detailed explanation
Public access is not authenticated or scoped operational access.
Public access is not authenticated or scoped operational access.
A root password cannot provide a narrow scope and is difficult to rotate or audit safely.
A root password cannot provide a narrow scope and is difficult to rotate or audit safely.
The role and trust relationship allow scoped, temporary access without sharing a long-term credential.
The role and trust relationship allow scoped, temporary access without sharing a long-term credential.
A shared long-term key expands the risk of disclosure and weakens accountability.
A shared long-term key expands the risk of disclosure and weakens accountability.
Check official documentation
Compare the following points with the official documentation.
IAM User GuideのIAM rolesとAWS STS AssumeRoleの説明を確認する。
What to confirm
許可された主体だけがロールを引き受け、ロールポリシーの範囲で一時的に作業できる。
Key points
- Cross-account access
- IAM role
- Trust policy
Notes
- Environment: AWS公式IAM・STSドキュメントの確認
- Confirm current IAM capabilities and recommended practices in the official AWS documentation.
Foundation review
Trust and permission
A role's trust policy and permissions policy solve different parts of the access decision.
Temporary session
An assumed-role session can expire and limits the impact of credential sharing.