Question

A financial services company uses AWS IAM Identity Center integrated with an external SAML identity provider. Auditors from a third-party firm require read-only console access to only the two AWS accounts in the 'Production-Regulated' OU during a 90-day engagement. Company policy mandates that no long-lived credentials be created, access must expire automatically at the end of the engagement, and auditors must never be able to reach any other account in the organization. Which approach best meets these requirements with the least ongoing administrative effort?

Accepted Answer

Create a permission set with the ReadOnlyAccess AWS managed policy and a maximum session duration, then assign the auditor group only to the two accounts in the Production-Regulated OU; remove the assignments after 90 days.

Answer

Create an IAM user with the ReadOnlyAccess policy in each of the two production accounts, share the credentials with the auditors, and delete the users after 90 days.

Answer

Create a cross-account IAM role with ReadOnlyAccess in the management account and instruct auditors to assume it, relying on an SCP to block access to other accounts.

Answer

Attach the ReadOnlyAccess permission set to the entire organization root and use a tag policy to restrict auditors to the Production-Regulated OU.