Question

A SaaS monitoring company needs to access resources in your AWS account to collect CloudWatch metrics. Your security team wants to grant the third party cross-account access via an IAM role while preventing the 'confused deputy' problem, where another of the vendor's customers could trick the vendor into accessing your account. What should you configure on the role's trust policy?

Accepted Answer

Add a Condition that requires the vendor to pass a unique ExternalId value when calling sts:AssumeRole

Answer

Attach an identity-based policy to the vendor's IAM user granting sts:AssumeRole on your role

Answer

Enable MFA on the vendor's account and require aws:MultiFactorAuthPresent in the trust policy

Answer

Restrict the trust policy to the vendor's account ID only, without any additional conditions