Question

A SaaS monitoring vendor needs read-only access to metrics in your AWS account. The vendor instructs you to create an IAM role that trusts the vendor's AWS account ID so their service can call sts:AssumeRole into your account. Your security team is concerned that another customer of the same vendor could trick the vendor's service into accessing your account. Which configuration best mitigates this confused deputy risk while allowing the vendor's access?

Accepted Answer

Add a condition to the role's trust policy requiring sts:ExternalId to match a unique value that the vendor associates with your account.

Answer

Restrict the role's permissions policy to read-only actions and attach a permission boundary limiting the role's maximum privileges.

Answer

Require MFA in the trust policy by adding a condition on aws:MultiFactorAuthPresent for the vendor's assume-role call.

Answer

Configure the trust policy to allow only a specific source IP range belonging to the vendor using the aws:SourceIp condition key.