A regional emergency-services consortium needs staff from county A to administer resources in county B’s AWS account for a joint CAD reporting app. Which design provides that access without sharing passwords?
Select an answer to reveal the explanation.
Short Explanation
You would not mail the other county the keys to the evidence room. Instead, county B publishes a role that county A’s staff can assume—trust policy, optional external ID, short-lived session. They get admin rights in B without ever sharing a password.
Full Explanation
Cross-account access is implemented with IAM roles whose trust policies allow principals from another AWS account to call AssumeRole (often with an external ID for third-party or multi-org scenarios). Temporary credentials from the assumed role grant administration in the target account without sharing root passwords or long-lived access keys. Public console exposure or committing keys into repositories is insecure.