Question

A CloudOps engineer works for a SaaS monitoring vendor that must access its customers' AWS accounts to read CloudWatch metrics. Each customer creates an IAM role that trusts the vendor's AWS account and grants read-only CloudWatch access. During a security review, the engineer is warned that a malicious third party who learns a customer's role ARN could potentially trick the vendor's service into assuming that role on the attacker's behalf. Which approach should the vendor require its customers to implement to prevent this cross-account access risk?

Accepted Answer

Require each customer to include a unique external ID in the role's trust policy condition that the vendor supplies and passes on every AssumeRole call.

Answer

Require each customer to attach a permissions boundary to the IAM role limiting it to CloudWatch read-only actions.

Answer

Require each customer to add an IP-address condition to the role trust policy restricting AssumeRole to the vendor's NAT gateway addresses.

Answer

Require each customer to enable MFA on the IAM role and provide the vendor with a hardware token for each account.