A company needs to provide a team of contractors with temporary access to the company's AWS resources for a short-term project. The contractors need…

The most efficient and secure method to provide temporary access is by using AWS Security Token Service (STS) in conjunction with IAM roles. This approach allows you to create distinct IAM roles with specific, least-privilege permissions tailored to different contractor needs. Contractors can then assume a role to receive temporary security credentials with a predefined expiration time. This automates the access revocation process, as the credentials automatically become invalid upon expiration, directly fulfilling the requirement to revoke permissions with the least operational overhead. This method avoids the security risks and manual effort associated with long-lived IAM user credentials.

A. Creating IAM users generates long-term credentials and requires manual deactivation, which increases operational overhead and the risk of forgotten, active accounts.

C. AWS Config is a service for monitoring and evaluating resource configurations for compliance, not for granting or managing user access credentials.

D. CloudTrail and EventBridge are used for auditing API activity and triggering automated responses, not for proactively provisioning temporary access.

1. AWS IAM User Guide

"Roles terms and concepts": "A role does not have standard long-term credentials such as a password or access keys associated with it. Instead

when you assume a role

it provides you with temporary security credentials for your role session." This highlights the temporary nature of role-based access.

2. AWS Security Token Service User Guide

"Temporary security credentials in IAM": "You can use the AWS Security Token Service (AWS STS) to create and provide trusted users with temporary security credentials that can control access to your AWS resources... Because the credentials are short term

you don't have to rotate them or worry about them when they are no longer needed." This directly supports the use of STS for temporary access with automated expiration.

3. AWS IAM User Guide

"Security best practices in IAM": Under the "Require human users to use temporary credentials" section

it states: "For human users that need long-term access to the AWS Management Console or AWS APIs

we recommend that you use IAM Identity Center... For other use cases that require long-term credentials

we recommend that you create IAM users. However

for human users that need temporary access

we recommend that you use IAM roles." This explicitly recommends roles for temporary access scenarios like the one described.