Cross-account analytics consumers need access to a municipal shared data lake. Direct long-term access keys are rejected by security. How should consumers authenticate?
Select an answer to reveal the explanation.
Short Explanation
Borrow a visitor badge that expires—don’t mail everyone a master key. Cross-account AssumeRole gives temporary credentials into the lake account. Static keys, root in notebooks, or public buckets are the bad shortcuts security already rejected.
Full Explanation
Cross-account IAM role assumption issues short-lived credentials through STS, which aligns with least privilege and eliminates long-lived access keys for analytics consumers. Resource policies on lake buckets or Lake Formation grants can further scope what each role may read. Distributing static keys, embedding root credentials, or opening buckets publicly increases blast radius and violates typical municipal security baselines. Prefer temporary cross-account roles for shared data lake access.