What Is the Most Secure Way to Get Temporary Cross-Account Access in AWS?

DVA-C02 By islever Editorial Last updated Aug 27, 2026

Short answer

C Create a cross-account access role, and use sts:AssumeRole API to get short-lived credentials.

Question

A developer needs temporary access to resources in a second account. What is the MOST secure way to achieve this?

Use the Amazon Cognito user pools to get short-lived credentials for the second account.
Create a dedicated IAM access key for the second account, and send it by mail.
Create a cross-account access role, and use sts:AssumeRole API to get short-lived credentials. Correct Answer
Establish trust, and add an SSH key for the second account to the IAM user.

Key Takeaways

This question tests your understanding of IAM roles and temporary credentials as a security best practice; the common trap is choosing an option that provides credentials but lacks the controlled, temporary, and auditable nature of role assumption.

The AWS Developer Associate exam tests secure cross-account access. The community consensus is that the most secure method is to create a cross-account IAM role and use sts:AssumeRole to obtain temporary short-lived credentials, rather than sharing long-term access keys or using other services.

Common mistake: Option B (dedicated IAM access key sent by mail) is a common wrong answer because it seems straightforward, but it involves long-term credentials that are not temporary, not scoped to the user, and can be intercepted, violating AWS security best practices.

Expert Analysis

Why the Answer Is Correct

Option C is correct because cross-account access roles with sts:AssumeRole are the AWS-recommended mechanism for granting temporary, least-privilege access to resources in another account. As Comment [1] states, this method provides temporary, limited access without sharing long-term credentials, ensuring security and adherence to best practices. Comment [2] explains the process: an IAM role is created in the target account with a trust policy allowing the developer's account to assume it, and the developer then calls sts:AssumeRole to get short-lived credentials.

Why the Other Options Are Wrong

Option A (Cognito user pools) is designed for identity management and authentication for app users, not for granting AWS API access to resources in a separate AWS account; it does not provide cross-account IAM authorization. Option B (dedicated IAM access key) creates long-term credentials that remain valid indefinitely, are not temporary, and sending them by mail is insecure. Option D (SSH key for IAM user) is not an AWS IAM concept; IAM users use access keys, passwords, or certificates, not SSH keys for API access, and this does not provide temporary credentials.

Community Comment Notes

Comment [1] and [2] both directly support option C, with [2] providing a clear step-by-step explanation of how to implement the solution. Comment [3] simply agrees with C. The community's unanimous vote for C reinforces that this is a fundamental AWS security concept: use roles for cross-account access, never share long-term keys.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When you see 'temporary access' or 'cross-account' in a question, immediately think IAM roles and sts:AssumeRole. Rule out any option involving long-lived credentials (access keys, passwords) or services that are not designed for IAM authorization (like Cognito unless the context is app users).

Community Votes

100%

100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

trungtd 👍 4 Answered C

Here's how it works: 1. Create an IAM Role in the Second Account: The administrator of the second account creates an IAM role and attaches policies that grant permissions to the resources that the developer needs to access. The trust policy of the role allows the first account (the developer's account) to assume this role. 2. Assume the IAM Role: The developer in the first account can then call the sts:AssumeRole API operation, passing the ARN of the role to assume in the second account. If the request is successful, the response includes temporary security credentials that the developer can use to access resources in the second account.
608064a 👍 4 Answered C

C. Create a cross-account access role, and use sts:AssumeRole API to get short-lived credentials. This method provides temporary, limited access to the necessary resources in the second account without sharing long-term credentials, ensuring security and adherence to best practices.
65703c1 👍 1 Answered C

C is the correct answer.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Practice All DVA-C02 Questions

Access 100 questions with complete answers and detailed explanations.

View Full DVA-C02 Practice Test →

← Back to DVA-C02 Study Guide