AWS SAA-C03 - Practice Test #6
Solutions Architect level practice test featuring complex scenarios, cost optimization, and resilient architectures.
A MedTech startup stores X-rays in an Amazon S3 bucket. They have hired a third-party analytics company (SaaS) that requires read-only access to this bucket to train their AI models. The third-party company will provide their own AWS account ID. How can third-party access be secured in a safe and auditable manner strictly following the PRINCIPLE OF LEAST PRIVILEGE?
Category: Design Secure Architectures
Explanation
Detailed breakdown of the correct answer
Cross-Account Access and External ID
To grant third parties (like a SaaS provider) access to AWS resources, the best practice is to use IAM Roles (AssumeRole) instead of long-term users. To prevent the "Confused Deputy" vulnerability, an 'External ID' must be required in the trust policy.
Therefore, the correct answer is: Create an IAM Role in the startup's account with a Trust Policy allowing the external account to assume it, requiring an External ID.
The option that says: Create an IAM User... and generate Access Keys is incorrect because using long-term credentials (Access Keys) violates security best practices, increasing the risk of leaks.
The option that says: Configure a Bucket Policy... based on IP is incorrect because IP addresses can be spoofed or change in dynamic cloud environments, making this solution brittle and less secure.
The option that says: Establish a VPC Peering connection... is incorrect because VPC peering connects private networks, but S3 is a public AWS service. Furthermore, network connection does not replace the need for API-level IAM authorization.