A contractor needs time-limited read-only access to a staging AWS account. Which design best matches temporary, conditional access?
Select an answer to reveal the explanation.
Short Explanation
Contractors get a visitor badge that expires—not a forever master key mailed in plain text. A read-only role with a short session and MFA condition matches that idea. Permanent admin users and shared keys are how staging becomes a standing risk.
Full Explanation
Temporary access for contractors is best delivered through IAM roles (or Identity Center assignments) with least-privilege read-only policies, constrained session duration, and conditions such as aws:MultiFactorAuthPresent. Permanent privileged IAM users, shared employee keys, and exposed root credentials create durable secrets and excess privilege beyond the staging need.