Exam AWS Certified Developer - Associate DVA-C02 topic 1 question 349 discussion

C is the correct answer.

C. Create a cross-account access role, and use sts:AssumeRole API to get short-lived credentials. This method provides temporary, limited access to the necessary resources in the second account without sharing long-term credentials, ensuring security and adherence to best practices.

Here's how it works: 1. Create an IAM Role in the Second Account: The administrator of the second account creates an IAM role and attaches policies that grant permissions to the resources that the developer needs to access. The trust policy of the role allows the first account (the developer's account) to assume this role. 2. Assume the IAM Role: The developer in the first account can then call the sts:AssumeRole API operation, passing the ARN of the role to assume in the second account. If the request is successful, the response includes temporary security credentials that the developer can use to access resources in the second account.