AWS Interview DropIntermediate TierScenario+25 XP on read
Explain how AWS IAM Role assumption works across different AWS accounts securely.
#IAM#Security#STS
Core Summary
Cross-account access lets one AWS account securely delegate permissions to resources in another account without ever sharing long-term credentials. The trust policy says who may assume; the permissions policy says what they can then do.
Hints
Hint 1: Think about temporary credentials and STS
Hint 2: Principal element in Trust Policy
Hint 3: ExternalId best practice for multi-tenant SaaS
Reported in interviews at Amazon, Atlassian