Exam AWS Certified Solutions Architect - Professional SAP-C02 topic 1 question 149 discussion

Option B is the best solution. This solution creates an IAM role that trusts the auditors' AWS account and attaches the required IAM policies to the role. This ensures that the auditors have read-only access to the company's AWS account while ensuring that the company's AWS account is secure and complies with AWS security best practices. Additionally, the unique external ID assigned to the role's trust policy adds an extra layer of security.

When granting external parties access to your AWS account, use cross-account IAM roles with a trust policy for their AWS account and an external ID to prevent the confused deputy problem. Attach least-privilege permissions (e.g., ReadOnlyAccess). This avoids sharing permanent credentials and aligns with AWS security best practices.

https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user.html

To create an IAM role that trusts the auditors' AWS account, you can do the following: Sign in to the AWS Management Console and open the IAM console. In the navigation pane, choose Roles, and then choose Create role. Choose the Custom trust policy role type. In the Custom trust policy section, enter or paste the following trust policy: { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::<auditor-account-id>:root" }, "Action": "sts:AssumeRole" } ] }

Option B

B is correct

its a b

In the company's AWS account, create an IAM role that trusts the auditors' AWS account.

B seems to be the right answer

The correct answer is B. In the company's AWS account, create an IAM role that trusts the auditors' AWS account. Create an IAM policy that has the required permissions. Attach the policy to the role. Assign a unique external ID to the role's trust policy. This solution meets the requirement of providing the external auditors with secure, read-only access to the company's AWS account while also complying with AWS security best practices. In this solution, an IAM role is created that trusts the auditors' AWS account and has an IAM policy with the required permissions attached to it. The role's trust policy should include a unique external ID for added security. This allows the external auditors to assume the role and access the resources with the permissions specified in the policy, without the need to share access keys or create individual IAM users for each auditor.

B is correct