Outside contractors need temporary access to a city AWS account without long-lived shared IAM user passwords. Which IAM identity approach best fits that temporary access pattern?
Select an answer to reveal the explanation.
Short Explanation
Roles are visitor badges that expire — contractors assume a role, get temporary credentials, and leave without owning a permanent shared login. Shared passwords, root emails, and public access keys are how temporary work turns into permanent risk.
Full Explanation
IAM roles are designed for temporary, assumable access with short-lived credentials, which fits contractor engagements better than shared long-lived IAM users. Shared passwords, root credential distribution, and publicly stored permanent keys are insecure patterns. Using roles aligns with AWS identity best practices for temporary access.