Question

A SaaS monitoring vendor needs read access to objects in your company's S3 buckets. The vendor asks you to create an IAM role that their AWS account can assume via sts:AssumeRole. Your security team is concerned that another customer of the same vendor could trick the vendor's software into accessing your buckets (a confused deputy attack). Which configuration in your role's trust policy most directly mitigates this risk?

Accepted Answer

Add a Condition that requires sts:ExternalId to match a unique value that you and the vendor agree upon

Answer

Restrict the Principal in the trust policy to the vendor's root account ARN only

Answer

Attach a permissions boundary to the role limiting it to s3:GetObject

Answer

Add an aws:SourceIp condition that limits assumption to the vendor's published NAT gateway IP ranges