What problem does the ExternalId value in a third-party role trust policy solve?

Question

Accepted Answer

The confused deputy — it stops the vendor using your role on another customer's behalf — A vendor that manages many customers could be tricked into assuming your role while acting for someone else; requiring an ExternalId that only you and the vendor know ties each assumption to the right customer. It is not a credential replacement, carries no network binding, and does not expire on its own.

Answer

Credential theft — it acts as a shared secret that replaces the vendor's access keys

Answer

Session hijacking — it binds the session to the network the vendor connected from

Answer

Privilege creep — it forces the vendor to re-request the role after each engagement

What problem does the ExternalId value in a third-party role trust policy solve?

Why this is the answer

More AWS IAM: Identity and Access Management Policies flashcards