A break-glass admin CLI session for a municipal tax tool should avoid permanent access keys on a laptop. What is the preferred credential pattern?
Select an answer to reveal the explanation.
Short Explanation
Break-glass should feel like a timed visitor badge with MFA, not a forever key on a laptop sticker. STS temporary credentials shrink the blast radius. Root keys on the desktop are the opposite of break-glass hygiene.
Full Explanation
Break-glass admin CLI access to a municipal tax tool should use short-lived STS session credentials, preferably with MFA, rather than permanent access keys stored on a laptop. Temporary sessions limit how long a stolen laptop credential remains useful, improve auditability of who assumed the emergency role, and avoid root or long-term IAM keys lingering on disk after the incident window closes. Pair the pattern with alerting on AssumeRole for that break-glass role.
Saving root account access keys in a plaintext desktop file is among the highest-risk credential practices in AWS. Emailing long-term IAM user keys to the on-call phone “forever” spreads static secrets through mail and MDM backups. Disabling MFA to speed CLI login during incidents removes a control exactly when account-takeover risk and urgency are highest.
Exam caveat: break-glass roles should remain narrowly documented, monitored, and time-bounded; MFA-protected AssumeRole is the exam-friendly pattern over standing laptop keys. Operational check: assume the break-glass role with MFA to obtain session credentials, complete the tax-tool incident task, wait for session expiry or revoke the session, and verify subsequent CLI API calls fail until a new MFA-backed session is created.