An AWS partner company is building a service in AWS Organizations using Its organization named org. This service requires the partner company to have…

The most secure method for granting a third-party, cross-account access is to use an IAM role with a trust policy that requires an external ID. This approach provides temporary credentials via the sts:AssumeRole action, adhering to the principle of least privilege. The external ID is a unique value shared between the customer and the partner, which the partner must include in the assume-role request. This prevents the "confused deputy" problem, where the partner could be tricked into using its permissions to act on an unauthorized account's resources.

A. Sharing root account access keys provides unrestricted access and is the least secure method, violating fundamental AWS security best practices.

B. Using long-lived IAM user credentials is less secure than using temporary credentials obtained by assuming a role, as they are more susceptible to compromise.

C. While using an IAM role is the correct pattern, it is not the most secure method without an external ID, leaving it vulnerable to the confused deputy problem.

1. AWS IAM User Guide

"How to use an external ID when granting access to your AWS resources to a third party": This document explicitly states

"For security

we recommend that you use an external ID... The external ID is a piece of information that you can use in an IAM role trust policy to designate who can assume the role." It further explains how this mitigates the confused deputy problem.

2. AWS IAM User Guide

"IAM tutorial: Delegate access across AWS accounts using IAM roles": This tutorial outlines the standard procedure for cross-account access using roles. The section on "Role trust policy" shows how to specify the trusted account principal

which is the foundation for the solution.

3. AWS Security Best Practices Whitepaper

"AWS Security Best Practices" (Page 21): This whitepaper advises

"When you grant a third party access to your AWS resources

you should use an IAM role. In the role's trust policy

you should use an external ID." This reinforces the use of an external ID as a best practice for third-party access scenarios.