A third-party auditor is being brought in to review security processes and configurations for all of a company`s AWS accounts. Currently, the company does not use any on-premises identity provider. Instead, they rely on IAM accounts in each of their AWS accounts. Now the auditor needs read-only access to all AWS resources for each AWS account. The auditor has an IAM user in his AWS account. Given the requirements, what is the most secure and easiest method for architecting access for the security auditor? Choose the correct answer from the options below.

Answer options:

A.Create an IAM user for each AWS account with read-only permission policies for the auditor, and disable each account when the audit is complete.
B.Configure an on-premise AD server and enable SAML identity federation for single sign-on to each AWS account.
C.Create an IAM role with read-only permissions to all AWS services in each AWS account. Allow the auditor IAM user to assume the ARN role for each AWS account.
D.Create a custom identity broker application that allows the auditor to use existing Amazon credentials to log into the AWS environments.

Answer – C
Option A is incorrect because creating an IAM User for each AWS account is an overhead and less preferred way than creating IAM Role.
Option B is incorrect because the scenario says that the company does not have any on-premises identity provider. This method is not straightforward.
Option C is CORRECT because it creates an IAM Role with all the necessary permission policies that allow the auditor to assume it while accessing the resources.
Option D is incorrect because using the IAM Role with the required permissions is the preferred and more secure way of accessing the AWS resources than using the Amazon credentials. Also, this option does not use the Security Token Service that gives temporary credentials to log in. Hence this is a less secure way of accessing the AWS resources.
For more information on IAM roles, please refer to the below URL-
http://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html