Exam AWS Certified Security - Specialty topic 1 question 4 discussion

Correct is A, C and F Using IAM to grant access to a Third-Party Account 1) Create a role to provide access to the require resources 1.1) Create a role policy that specifies the AWS Account ID to be accessed, "sts:AssumeRole" as action, and "sts:ExternalID" as condition 1.2) Create a role using the role policy just created 1.3) Assign a resouce policy to the role. This will provide permission to access resource ARNs to the auditor 2) Repeat steps 1 and 2 on all AWS accounts 3) The auditor connects to the AWS account AWS Security Token Service (STS). The auditor must provide its ExternalID from step 1.2, the ARN of the role he is trying to assume from step 1.3, sts:ExternalID 4) STS provide the auditor with temporary credentials that provides the role access from step 1 https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user_externalid.html https://aws.amazon.com/blogs/security/how-to-audit-cross-account-roles-using-aws-cloudtrail-and-amazon-cloudwatch-events/

For my A,C,F

A,C and F according to chatgpt

A,C and F is correct answer.

External ID is mainly used for securing any roles that can be assumed by an unauthorized external account. This is mainly done when you're providing any service to other accounts. Thus, A might not be in the correct options list.

" The Auditor is having trouble accessing some of the accounts." The last statement indicated that the Auditor have access to some of the accounts. In that case, A & B are no longer valid. My opinion though

For me A,C,F

I'll go for ACF

its ACF

https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user_externalid.html

https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user_externalid.html .....If the request comes from someone using Example Corp's AWS account, and if the role ARN and the external ID are correct, the request succeeds. It then provides temporary security credentials that Example Corp can use to access the AWS resources that your role allows.

Chat GCP saying, ACF

For people who confused about A, the auditor need to provide the external id to all accounts he assumes. It is possible that he entered the wrong one (or not at all) for just a few of them.

I wonder why A or E is correct. I think if they are correct, the auditor cannot access all the accounts.

if A appears to be the answers it will have no access to the other account also

A, C, F

correct