During an incident, a county break-glass role can be assumed with b…

Question

During an incident, a county break-glass role can be assumed with broad S3 read. Responders must further limit temporary credentials so s3:GetObject works only under the evidence/incident-42/ prefix. What should they pass when assuming the role?

Accepted Answer

Pass a session policy on AssumeRole that narrows s3:GetObject to the incident prefix. — Break-glass is already a big key—session policies shrink what that temporary badge can open. Pass a tighter policy on AssumeRole so GetObject only hits the incident prefix. Do not widen permanent admin or park keys in the ticket.

Answer

Attach AdministratorAccess to the break-glass role permanently so responders need no further limits.

Answer

Disable MFA and use long-lived access keys checked into the incident ticket.

Answer

Delete the bucket policy so IAM alone cannot restrict GetObject by prefix.

During an incident, a county break-glass role can be assumed with broad S3 read. Responders must further limit temporary credentials so s3:GetObject works only under the evidence/incident-42/ prefix. What should they pass when assuming the role?

Short Explanation

Full Explanation