Avoiding Permanent Credentials with AWS STS
A company has a software as a service (SaaS) application. The company has integrated the application with AWS services by using the AWS SDK and an IAM user's access key ID and secret access key. The company needs to implement the principle of least privilege for the IAM user. The company must avoid the usage of permanent credentials. Which solution will meet these requirements?
Community Insight
The core trap is choosing a permission-scoping option (C or D) which fails to address the requirement to avoid permanent credentials, while assuming the correct STS method requires specific context like SAML or external IDs.
This question addresses how to secure SaaS applications by eliminating permanent IAM credentials in favor of temporary security tokens using AWS Security Token Service (STS). The correct solution leverages AssumeRole to enforce least privilege and avoid long-term access keys.
Learners often select options C or D because they focus solely on 'least privilege' via policies/groups, ignoring the critical constraint to remove permanent IAM user access keys.
Community Discussion (2 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option B is the correct choice because it utilizes the AWS STS AssumeRole API to generate temporary security credentials. By restricting the underlying IAM user's permissions to only call AWS STS (specifically AssumeRole), the application adheres to the principle of least privilege for that user account. The resulting temporary credentials have their own attached role policy, allowing granular control over what the application can do, thus satisfying both requirements: avoiding permanent credentials and enforcing least privilege.Why the Other Options Are Wrong
Option A (AssumeRoleWithSAML) is incorrect because it requires a SAML identity provider integration, which is not mentioned in the scenario; this is typically used for federated users from external IdPs like Active Directory, not standard SaaS SDK integrations. Option C and Option D are incorrect because they rely on static IAM user/group policies. Even if scoped tightly, these solutions still require the use of permanent Access Key ID and Secret Access Key, violating the explicit requirement to avoid permanent credentials.Community Comment Notes
Community consensus strongly favors Option B as the standard pattern for replacing long-term keys with short-lived tokens. One commenter noted that limiting the IAM user to only STS calls is the key to securing the entry point. Another highlighted that AssumeRole provides temporary credentials specifically designed for this purpose, whereas SAML is unnecessary complexity here.Official Reference
Exam Strategy
Always check for constraints regarding credential types (permanent vs. temporary) before selecting a security solution. If the question asks to avoid permanent credentials, immediately eliminate any option relying on IAM Users with Access Keys and look for STS, Instance Profiles, or Role-based authentication.
Frequently Asked Questions
Why not just add a policy to the IAM user?
Adding a policy scopes permissions but still requires permanent Access Keys, violating the requirement to avoid them.
When should I use AssumeRoleWithSAML instead?
Use AssumeRoleWithSAML when integrating with an external Identity Provider (like AD FS or Okta) that issues SAML assertions, not for direct SaaS SDK usage.
Related Analysis
Practice All SOA-C03 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SOA-C03 Practice Test →