Q: What is cross-account IAM role assumption, and why is it considered safer than creating IAM users in every account?
If you have 10 AWS accounts (Dev, QA, Prod for various products), creating 10 individual IAM Users for an engineer means 10 sets of perma...
#Security #Security #L2 #DevSecOps #Compliance #IAM
🎙️ Candidate Opening & Architectural Context
""Least-privilege access, encrypted secrets in transit/at rest, and continuous vulnerability scanning are foundational. The interviewer is testing: STS AssumeRole, centralized identity management, reducing attack surface.. I structure my answer around systematic triage first, root cause analysis second, and permanent remediation third.""
Advertisement
🛠️ Production Runbook & Step-by-Step Resolution
1️⃣
Initial Diagnostics & Root Cause Analysis
If you have 10 AWS accounts (Dev, QA, Prod for various products), creating 10 individual IAM Users for an engineer means 10 sets of permanent access keys to manage, rotate, and potentially leak.
- The engineer has a single IAM User (or SSO identity) exclusively in a central "Identity Account".
- In the "Prod Account", an IAM Role is created that trusts the Identity Account.
- The engineer uses the AWS CLI/Console to run
AssumeRole. AWS STS issues temporary, short-lived (e.g., 1 hour) credentials to act as that Role in the Prod Account.
2️⃣
Remediation & Permanent Safeguards
A safer architecture is a Hub and Spoke model using sts:AssumeRole. This inherently forces credential expiration and allows security teams to manage all identities from a single pane of glass.
💡 The Senior SRE Gold Nugget (Key Architectural Takeaway)
"Pro-Tip: The engineer has a single IAM User (or SSO identity) exclusively in a central "Identity Account".."
⚡ 60-Second Elevator Pitch Talking Points
- The engineer has a single IAM User (or SSO identity) exclusively in a central "Identity Account".
- In the "Prod Account", an IAM Role is created that trusts the Identity Account.
- The engineer uses the AWS CLI/Console to run AssumeRole. AWS STS issues temporary, short-lived (e...
Advertisement