Cross-Account IAM Role Delegation for Vendors

SAA-C03 By islever Editorial Last updated Oct 14, 2026

Short answer

A Create an IAM role in the company’s account to delegate access to the vendor’s IAM role.

Question

A company has hired an external vendor to perform work in the company’s AWS account. The vendor uses an automated tool that is hosted in an AWS account that the vendor owns. The vendor does not have IAM access to the company’s AWS account. The company needs to grant the vendor access to the company’s AWS account. Which solution will meet these requirements MOST securely?

Create an IAM role in the company’s account to delegate access to the vendor’s IAM role. Attach the appropriate IAM policies to the role for the permissions that the vendor requires. Correct Answer
Create an IAM user in the company’s account with a password that meets the password complexity requirements. Attach the appropriate IAM policies to the user for the permissions that the vendor requires.
Create an IAM group in the company’s account. Add the automated tool’s IAM user from the vendor account to the group. Attach the appropriate IAM policies to the group for the permissions that the vendor requires.
Create an IAM user in the company’s account that has a permission boundary that allows the vendor’s account. Attach the appropriate IAM policies to the user for the permissions that the vendor requires.

Key Takeaways

The core concept is role assumption; the common trap is creating long-lived user credentials which violate least privilege and security best practices.

This question tests secure cross-account access using IAM roles to allow an external vendor to assume permissions without direct credentials.

Common mistake: Candidates often choose option B (IAM User) because it seems simpler, but it requires sharing static credentials or passwords, which is less secure than temporary session tokens from a role.

Expert Analysis

Why the Answer Is Correct

Option A is the correct answer because AWS IAM Roles are designed specifically for cross-account delegation. By creating a role in the company's account with a trust policy that allows the vendor's account ID to assume it, the vendor can obtain temporary security credentials. This adheres to the principle of least privilege and avoids the need to share long-term credentials like passwords or access keys.

Why the Other Options Are Wrong

Option B creates an IAM User, which implies long-term credentials (passwords/access keys). Sharing these with an external vendor is a significant security risk compared to short-lived role sessions. Option C is invalid because you cannot add users from another account directly into a group in your own account; groups only contain local users. Option D mentions permission boundaries, which limit what a user can do but do not facilitate cross-account access or trust relationships.

Community Comment Notes

Community consensus strongly supports Option A. As Mikado211 noted, "When you have somebody from another account who needs a resource in your account - create a role to access to this account." Salilgen provided the official documentation link confirming this scenario. JA2018 emphasized that roles adhere to least privilege better than users by avoiding direct login credentials.

Official Reference

https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_common-scenarios_third-party.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

Always look for 'cross-account' or 'external entity' scenarios. The immediate pattern match should be IAM Role with a Trust Policy. Avoid IAM Users unless the entity is internal and requires persistent console/API access.

Frequently Asked Questions

Why can't I just add the vendor's user to my group?

Groups can only contain IAM users within the same AWS account. Cross-account access requires a Role with a trust policy.

Is an IAM User ever safe for vendors?

Generally no. Roles provide temporary credentials, reducing risk. Users require long-term secrets which are harder to manage securely externally.

More SAA-C03 FAQ →

Community Votes

100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 6 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 6

Mikado211 👍 7 Answered A

When you have somebody from another account who needs a resource in your account - create a role to access to this account - allow the remote account to asume the role.
Scheldon 👍 2 Answered A

AnswerA I would go with option A
JA2018 👍 1 Answered A

Least privilege principle: Using an IAM role instead of a user adheres to the least privilege principle as it only grants the vendor access to specific actions needed for their task, not full account access like a user would have. No direct access to the company account: By delegating access through a role, the vendor's IAM user in their own account does not need to have direct login credentials to the company's AWS account, enhancing security. Granular control: IAM policies attached to the role can be carefully crafted to provide only the necessary permissions for the vendor's automated tool, limiting potential damage in case of unauthorized access
Salilgen 👍 1 Answered A

https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_common-scenarios_third-party.html
Andy_09 👍 7

Option A looks ok

Show 1 more comment

osmk 👍 6 Answered A

Question #222

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide