A partner firm's consultant needs temporary read access to one S3 prefix in your account. Your policy requires no long-lived credentials and must limit how the grant can be misused by others. Which design meets these needs?
Show answer and explanation
Answer: D
A cross-account IAM role that the consultant assumes through STS yields short-lived credentials, and an external ID in the role's trust policy guards against the confused deputy problem. The permissions can be limited to the single prefix and revoked by changing the role. Long-lived user keys, shared root credentials and public buckets each break the stated requirements.
Why the other options are wrong
- A. A long-term IAM user access key stays valid until someone removes it, which violates the requirement to avoid long-lived credentials.
- B. Root credentials grant unrestricted control over the entire account, so they must never be handed to an outside party.
- C. Public read access exposes the prefix to anyone on the internet, far beyond the one consultant who needs it.