A SaaS monitoring vendor needs read access to a customer's AWS account. The customer worries other vendor customers could guess the role ARN and get confused-deputy access. What should the trust policy include?
A.MFA condition on the role
MFA doesn't prevent a deputy who legitimately has creds from misusing them.
B.An ExternalId condition unique to this customer
ExternalId = the confused-deputy countermeasure. Correct.
C.A resource-based policy on each resource
Resource policies alone don't solve role-ARN knowledge abuse.
D.IP allowlist of the vendor's office
Vendor systems may not have static IPs — ExternalId is the designed solution.
Why this answer
The confused-deputy problem: third parties assume your cross-account role — without a secret ExternalId, anyone who learns the role ARN could attempt assumption. ExternalId acts as a shared secret only the legitimate vendor knows — the standard third-party-access mitigation.
Correct answer: B · Last reviewed 2026-11-02
Official AWS references
Practice this interactively
Answer without seeing the solution first in the IAM & Access Control practice session.
Practice IAM & Access Control