ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

Using an IAM role that auditors can assume with temporary security credentials applies the concept of entitlement by granting the exact resource permissions needed and nothing more. Because the role issues short-lived credentials, it avoids the operational burden and risk of permanent IAM users. The role policy can limit actions to s3:GetObject on the specific bucket and can include an explicit expiration date or be deactivated at any time, allowing immediate revocation.

Granting access through bucket ACLs does not provide easy centralized revocation or granular control. Creating IAM users with expiring passwords still leaves long-lived access keys unless additional steps are taken and contradicts the requirement to avoid persistent identities. A bucket policy that opens access to anyone from specific IP ranges violates least privilege by not tying permissions to a defined principal and is harder to track and revoke quickly.