A city auditor requires that a contractor AWS account may deploy in…

Question

A city auditor requires that a contractor AWS account may deploy into a project account only through a break-glass role that enforces MFA and short session durations. Which cross-account access design best satisfies the auditor?

Accepted Answer

Create a project-account IAM role trusting the contractor account with MFA conditions and a short max session duration, and grant contractors only sts:AssumeRole into that role—not standing admin in the project account. — Break-glass means a monitored, temporary key—not a spare admin badge left under the mat. Contractors assume a tight role with MFA and short sessions, then leave. Long-lived admin keys in their laptops fail the audit before lunch.

Answer

Issue long-lived IAM access keys from the project account directly to contractor laptops with AdministratorAccess.

Answer

Add the contractor account as a full Organizations management account peer with unrestricted SCPs disabled.

Answer

Allow anonymous account access using resource policies that skip principals and MFA.

A city auditor requires that a contractor AWS account may deploy into a project account only through a break-glass role that enforces MFA and short session durations. Which cross-account access design best satisfies the auditor?

Short Explanation

Full Explanation