Grant Tokens

Correct Answer: Amazon Cognito and AWS Security Token Service

Amazon Cognito is used for identity management and AWS Security Token Service (STS) is used to provide temporary security credentials. Neither Lambda nor IAM are directly involved in this process. Elastic Beanstalk, S3 Transfer Acceleration, App Runner, S3 Select, Step Functions, and S3 Multi-Part Upload are not related to providing grant tokens for uploading files to S3. API Gateway can be used for authentication, but in this case, Cognito and STS are better suited.

Correct Answer: Call AWS STS AssumeRoleWithSAML API

For federation with an external IdP, you must call the AWS STS AssumeRoleWithSAML API, which includes the SAML assertion information from the IdP. The GetSessionToken and GetFederationToken APIs do not provide handling for SAML assertions, and creating an IAM role or Cognito user pool would not be effective.

Correct Answer: Create a cross-account IAM role with least-privilege permissions and allow the vendor to assume it via AWS STS for temporary credentials.

The best practice is to provide temporary, least-privilege access by creating a cross-account IAM role that the vendor can assume using AWS Security Token Service (STS). This approach issues short-lived credentials, allows fine-grained permissions (for example, granting only the actions required, such as using AWS Systems Manager Session Manager to access a specific instance), supports auditing via CloudTrail, and can be quickly revoked by updating the role or trust policy. Sharing an EC2 key pair exposes long-lived credentials and is not auditable per user. Creating an IAM user with permanent access keys violates the principle of least privilege and is harder to manage and revoke. Merely adding the vendor’s IP to a security group only controls network reachability and does not authenticate or authorize the vendor, nor does it provide temporary, auditable access.