A vendor's consultant needs read access and a few narrow write actions in one application account for about two weeks. Security wants access to end automatically, MFA required for every session, and no long-lived credentials. Which design fits?
Show answer and explanation
Answer: B
A role gives the consultant temporary credentials instead of a standing user with long-lived keys, and its permission policy stays scoped to what the engagement requires. The trust policy can require MFA and use aws:CurrentTime with date conditions, so assumption stops when the window closes. A short maximum session duration further limits each session.
Why the other options are wrong
- A. Administrator access is far beyond what the engagement needs, and a reminder to delete the user is not an enforced expiry.
- C. The root user has unrestricted control of the account and cannot be scoped or time-limited. Sharing its password is never an acceptable way to grant vendor access.
- D. Developer group permissions are broader than the engagement needs, and disabling CloudTrail removes the audit trail the security team depends on.