A manufacturing plant runs software on servers outside AWS and needs those workloads to obtain temporary AWS credentials through IAM roles instead of long-term access keys. Which service enables this?
Show answer and explanation
Answer: A
IAM Roles Anywhere lets workloads running outside AWS present an X.509 certificate issued by a trust anchor you control, and in exchange they receive temporary credentials for an IAM role. Access is governed by the role's policies and by profiles that scope session duration and permissions.
This removes the need to distribute long-term access keys to on-premises servers, and revocation happens through the trust anchor or the certificate itself.
Why the other options are wrong
- B. IAM Identity Center federates human workforce users into accounts and applications, not server workloads.
- C. Cognito identity pools issue credentials to application end users, typically for mobile or web clients.
- D. Directory Service provides managed Microsoft AD or a Simple AD directory and does not broker AWS credentials for workloads.
Exam tip. Roles Anywhere exchanges a trusted X.509 certificate for temporary role credentials.