Avoiding Permanent Credentials with AWS STS
Short answer
B Migrate the application to use the AWS STS AssumeRole API operation to obtain temporary credentials, restricting the IAM user to only STS calls to enforce least privilege.
Question
The company needs to implement the principle of least privilege for the IAM user. The company must avoid the usage of permanent credentials.
Which solution will meet these requirements?
Key Takeaways
The core trap is choosing a permission-scoping option (C or D) which fails to address the requirement to avoid permanent credentials, while assuming the correct STS method requires specific context like SAML or external IDs.
This question addresses how to secure SaaS applications by eliminating permanent IAM credentials in favor of temporary security tokens using AWS Security Token Service (STS). The correct solution leverages AssumeRole to enforce least privilege and avoid long-term access keys.
Common mistake: Learners often select options C or D because they focus solely on 'least privilege' via policies/groups, ignoring the critical constraint to remove permanent IAM user access keys.
Expert Analysis
Why the Answer Is Correct
Option B is the correct choice because it utilizes the AWS STS AssumeRole API to generate temporary security credentials. By restricting the underlying IAM user's permissions to only call AWS STS (specifically AssumeRole), the application adheres to the principle of least privilege for that user account. The resulting temporary credentials have their own attached role policy, allowing granular control over what the application can do, thus satisfying both requirements: avoiding permanent credentials and enforcing least privilege.
Why the Other Options Are Wrong
Option A (AssumeRoleWithSAML) is incorrect because it requires a SAML identity provider integration, which is not mentioned in the scenario; this is typically used for federated users from external IdPs like Active Directory, not standard SaaS SDK integrations. Option C and Option D are incorrect because they rely on static IAM user/group policies. Even if scoped tightly, these solutions still require the use of permanent Access Key ID and Secret Access Key, violating the explicit requirement to avoid permanent credentials.
Community Comment Notes
Community consensus strongly favors Option B as the standard pattern for replacing long-term keys with short-lived tokens. One commenter noted that limiting the IAM user to only STS calls is the key to securing the entry point. Another highlighted that AssumeRole provides temporary credentials specifically designed for this purpose, whereas SAML is unnecessary complexity here.
Official Reference
https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html
This link opens the official vendor documentation in a new tab.
Exam Strategy
Always check for constraints regarding credential types (permanent vs. temporary) before selecting a security solution. If the question asks to avoid permanent credentials, immediately eliminate any option relying on IAM Users with Access Keys and look for STS, Instance Profiles, or Role-based authentication.
Frequently Asked Questions
Why not just add a policy to the IAM user?
When should I use AssumeRoleWithSAML instead?
Discussion 2 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 2
-
fae00bd 👍 1 Answered AA - is correct because AssumeRoleWithSAML provides temporary AWS credentials without requiring the IAM user’s permanent access keys. The application authenticates through a SAML identity provider and assumes an IAM role whose permissions are limited to the actions and resources it needs. This meets both requirements: least privilege and avoiding permanent AWS credentials. https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithSAML.html B - does not fully meet the requirements. Although AssumeRole returns temporary credentials, the IAM user in this solution still uses permanent access keys to call STS. Restricting the user’s permissions to STS does not eliminate those keys. C and D limit permissions but also retain permanent credentials.
-
Bad_Mat 👍 1 Answered BThe correct solution to meet these requirements is B.Migrating the application to use the AssumeRole API operation (and limiting the underlying IAM user strictly to AWS STS calls) eliminates the need to use long-term IAM user credentials. It provides the SaaS application with temporary security credentials instead of permanent ones, allowing you to enforce the principle of least privilege through the assigned role's permissions policy.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All SOA-C03 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SOA-C03 Practice Test →