A monitoring vendor needs read-only access to YOUR account via role assumption. Beyond least privilege, what protects against the 'confused deputy' problem where the vendor's OTHER customers could trick it into reading your account?
A.Restricting by the vendor's AWS account ID only
Vendor's account ID alone = classic confused deputy hole.
B.Requiring an ExternalId condition in the role trust policy — a shared secret only you and the vendor associate with your account
Correct. ExternalId binds the assumption to YOUR relationship.
C.MFA on the role
MFA helps but doesn't solve third-party deputy scenarios.
D.IP whitelisting in the trust policy
IPs change; ExternalId is the designed control.
Why this answer
ExternalId is the canonical confused-deputy mitigation: the trust policy requires sts:ExternalId = a secret string unique to your vendor relationship — the vendor can't accidentally assume your role on behalf of another customer. Account ID alone doesn't distinguish which customer initiated the call.
Correct answer: B · Last reviewed 2026-11-03
Official AWS references
Practice this interactively
Answer without seeing the solution first in the IAM Deep Dive practice session.
Practice IAM Deep Dive