Security World 1 · Who Can Do What · Stage 2

Trust Both Ways

Two accounts, two policies, one answer: both must allow. And the vendor's role must know which customer is asking.

  • Cross-account access
  • Role trust policies
  • sts:ExternalId
  • Presigned URLs
  • Session duration
Domain
Security
World
Security World 1: Who Can Do What (Associate)
Game type
Policy stepper: Edit identity, resource and key policies; the matrix shows the gate that decided.
Time
About 25 minutes on a first attempt (estimated)
Exam guides
  • SAA-C03Task 1.1: Design secure access to AWS resources
  • DEA-C01Skill 4.3.3: Configure encryption across AWS account boundaries
  • SAP-C02Task 1.2: Prescribe security controls
  • SCS-C03Skill 4.2.1: Design and evaluate authorization controls for human, application, and system access (for example, Amazon Verified Permissions, IAM paths, IAM Roles Anywhere, resource policies for cross-account access, IAM role trust policies); Skill 4.1.2: Configure mechanisms to issue temporary credentials (for example, AWS STS, Amazon S3 presigned URLs)