CloudGuild · Blog · Cheat sheets · Lessons · Certifications
Navigating Cross-Account Access for S3 Buckets
Learn the best practices for granting temporary access to S3 buckets across AWS accounts and avoid common pitfalls.
A common challenge in AWS certifications involves understanding secure access mechanisms between accounts. Many candidates trip over questions regarding cross-account access and security best practices. This question exemplifies that challenge.
The question
A company needs to grant an application running in Account B temporary access to objects in an S3 bucket owned by Account A. What is the MOST secure approach?
A: Create an IAM user in Account A and share its access keys with Account B
B: Create an IAM role in Account A that Account B can assume via STS, and grant it access to the bucket
C: Make the S3 bucket public and restrict by IP address
D: Email a set of long-lived credentials to the Account B team
Think before you scroll
Consider the security implications of each option. Temporary versus long-lived credentials play a crucial role in securing access. Also, think about the principle of least privilege and how to manage access across accounts effectively.
The answer
B: Create an IAM role in Account A that Account B can assume via STS, and grant it access to the bucket. This option provides the most secure approach by using temporary credentials that reduce the risk of long-term exposure.
Why the other options lose
A: Create an IAM user in Account A and share its access keys with Account B. This option is insecure because sharing long-lived access keys increases the risk of credential leakage. It also violates the principle of least privilege, as it grants more access than necessary.
C: Make the S3 bucket public and restrict by IP address. Making the bucket public exposes it to all internet traffic, which is inherently insecure. IP address restrictions can be easily spoofed and do not provide adequate security.
D: Email a set of long-lived credentials to the Account B team. Emailing long-lived credentials is risky and insecure. If these credentials are intercepted or mishandled, they can lead to unauthorized access.
The concept behind it
The principle of using IAM roles for cross-account access is fundamental. Roles allow you to grant temporary permissions securely. When a role is assumed via the Security Token Service (STS), it issues short-lived credentials that automatically expire, minimizing the risk of compromise.
Exam trap to remember
Remember the "temporary over long-lived" rule. Always favor options that use temporary credentials for cross-account access to enhance security.