Question

A company hires a third-party SaaS monitoring vendor that needs read-only access to CloudWatch metrics in the company's AWS account. The vendor will access the account programmatically from their own AWS account. The security team wants to grant this access without creating long-term IAM user credentials and wants to protect against the 'confused deputy' problem where the vendor could be tricked into accessing the wrong customer's account. What is the MOST secure way to configure this access?

Accepted Answer

Create an IAM role in the company account that trusts the vendor's AWS account, and require an external ID condition in the role's trust policy that the vendor must supply when assuming the role.

Answer

Create an IAM user in the company account, generate access keys, and email the keys securely to the vendor for programmatic access.

Answer

Create an IAM role in the company account that trusts the vendor's AWS account with no additional conditions, relying on the account ID alone for security.

Answer

Add the vendor's AWS account as a principal in a resource-based policy on CloudWatch and enable MFA for the vendor's federated users.