Question

A SysOps administrator is configuring an IAM role that a third-party SaaS monitoring vendor will assume to read CloudWatch metrics in the company's AWS account. The vendor manages a single AWS account that they use to access many of their customers' accounts. The security team is concerned that another of the vendor's customers could trick the vendor into accessing this company's account. Which configuration best mitigates this confused deputy risk?

Accepted Answer

Add a condition to the role's trust policy requiring an sts:ExternalId value that the vendor supplies uniquely for this customer

Answer

Attach a permission boundary to the role that limits it to CloudWatch read-only actions

Answer

Require MFA in the trust policy by adding an aws:MultiFactorAuthPresent condition

Answer

Restrict the trust policy principal to the vendor's account ID only