An external ETL vendor processes S3 data in a customer account.
Prevent the vendor from confusing one customer's role with another customer's role.
Which authentication approach is most appropriate?
Require an ExternalId in the trust policy and limit the trusted principal, role, and data prefix per customer.
Detailed explanation
A guessable resource name is not a reliable third-party identifier.
A guessable resource name is not a reliable third-party identifier.
A leaked long-lived maximum-privilege credential is unacceptable.
A leaked long-lived maximum-privilege credential is unacceptable.
Customer isolation is lost and misuse can affect all data.
Customer isolation is lost and misuse can affect all data.
The AssumeRole context is bound to the intended customer and can be audited.
The AssumeRole context is bound to the intended customer and can be audited.
Check official documentation
Compare the following points with the official documentation.
AWS IAM confused deputy、ExternalId、AssumeRole trust policyの公式説明を確認する。
What to confirm
ExternalIdと推測可能なリソース名・rootキーの違いを説明できる。
Key points
- ExternalId
- Confused deputy
- AssumeRole
- Third-party access
Notes
- Environment: AWS公式DEA-C01試験ガイドと各サービスの公式ドキュメントの確認
- Confirm current AWS service behavior in the official DEA-C01 documentation.
Foundation review
Identity and authorization
ExternalId is a trust condition, not a replacement for principal and permission controls.
Customer isolation
Separate roles, prefixes, keys, and audit records for each customer.