A media studio hires freelance editors who need project- and rating-based access to video assets, runs a thumbnail service on Amazon EKS needing S3 access, and operates an on-premises render farm that must call Amazon Rekognition without long-term keys. Access must be attribute-driven for humans, short-lived for workloads, and certificate-based for servers. Which authorization design should the security architect select to satisfy human, application, and system access?

Verified Permissions with Cedar policies provides centralized fine-grained authorization for human access based on attributes such as project and content rating, which IAM groups and paths cannot evaluate dynamically at request time, while IAM Roles for Service Accounts maps a Kubernetes service account to an IAM role through OIDC to give the thumbnail pods short-lived credentials without stored secrets, and IAM Roles Anywhere lets the on-premises render farm present X.509 certificates to a trust anchor to assume an IAM role without long-term access keys. Assigning path-based IAM users fails by concept because paths only organize identities and cannot enforce attribute-based video decisions. Embedding access keys in containers fails by concept because static keys violate short-lived workload requirements and expand rotation burden. Using shared long-lived keys for farm servers fails by concept because it reintroduces key sprawl instead of certificate-based temporary credentials. For the exam remember that Verified Permissions authorizes humans and applications with policies, it does not issue authentication, and in practice verify trust-anchor conditions, role session tags, and Cedar policy simulation before rollout.