A monitoring vendor assumes a read-only role in the company's account. The company wants to prevent the confused deputy problem, where another customer of the vendor could cause the vendor to use this role against the company. Which trust policy control should be used?
Show answer and explanation
Answer: A
An sts:ExternalId condition in the trust policy requires the caller to present a shared value when it assumes the role. The company chooses a unique value for each vendor relationship, and the vendor passes it with every AssumeRole call. A confused deputy cannot know that value, so it cannot trick the vendor into assuming the role. The value should be unique per customer rather than reused across accounts. The condition sits in the trust policy of the company's role, which is where the control is needed.
Why the other options are wrong
- B. aws:SourceVpc applies when requests arrive through a VPC endpoint. A vendor calling from its own infrastructure would fail this check, and the condition does nothing against a confused deputy that calls from outside the VPC.
- C. A permission boundary is attached in the vendor's account and only limits that vendor identity's permissions. The company cannot use it to restrict who assumes a role in the company's account, so it does not address the trust issue.
- D. A bucket policy controls access to one S3 bucket and does not govern AssumeRole calls. Listing the vendor's account would grant bucket access, not prevent misuse of the role.