Question

A financial services company uses AWS IAM Identity Center (successor to AWS SSO) with permission sets to give engineers console access across 40 accounts in AWS Organizations. A DevOps team now needs programmatic access from an on-premises Jenkins server to deploy into several member accounts. The security team mandates that no long-lived IAM access keys be stored on the Jenkins server, and that all access must be centrally auditable and time-bounded. Which approach best meets these requirements?

Accepted Answer

Configure the Jenkins server to retrieve short-lived credentials from IAM Identity Center by authenticating with the AWS CLI's SSO OIDC device/authorization flow, then assume the permission-set roles in each target account.

Answer

Create an IAM user with access keys in each target member account and store the keys in the Jenkins credential store, rotating them every 90 days.

Answer

Create a single cross-account IAM role in each member account trusting the Jenkins account, and have Jenkins assume it using an IAM user's long-lived keys from a central automation account.

Answer

Deploy an EC2 instance profile on the Jenkins server and use VPC peering so it can call AWS APIs in each member account directly without assuming roles.