Backend interview prep

Start

Cross Account Access Interview Questions (Top 15 Questions with Answers)

Master Cross Account Access Interview Questions with production-ready explanations covering AWS Cross-Account Access, IAM Role Assumption, Trust Policies, Azure Cross-Tenant Access, Google Cloud Cross-Project Access, Temporary Credentials, Kubernetes Workload Identity, and enterprise multi-cloud security.

Module Navigation

Previous: MFA QA | Parent: IAM Learning Path | Next: IAM Best Practices QA

Introduction

Modern enterprises rarely operate within a single cloud account.

Large organizations typically have:

  • Development Account
  • Testing Account
  • Staging Account
  • Production Account
  • Security Account
  • Shared Services Account
  • Logging Account
  • Networking Account

Applications and users often need secure access across multiple accounts without sharing credentials.

Cross Account Access enables secure communication between cloud accounts using:

  • Trust Relationships
  • IAM Roles
  • Temporary Credentials
  • Identity Federation
  • Role Assumption

Cloud providers implement Cross Account Access differently:

  • AWS → IAM Roles + AssumeRole
  • Azure → Cross-Tenant Access + RBAC
  • Google Cloud → IAM + Workforce/Workload Identity Federation
Account A
    │
    ▼
Assume Role
    │
Temporary Credentials
    │
    ▼
Account B

This guide contains 15 production-focused interview questions covering cross-account access, trust relationships, AssumeRole, temporary credentials, multi-cloud identity, Kubernetes identity, and enterprise security.

Learning Roadmap

Cross Account Access
        │
        ▼
Trust Relationships
        │
        ▼
IAM Roles
        │
        ▼
Temporary Credentials
        │
        ▼
Federation
        │
        ▼
Multi-Cloud Identity
        │
        ▼
Enterprise Security

Cross Account Fundamentals

1. What is Cross Account Access?

Cross Account Access allows identities from one cloud account to securely access resources in another account.

Example:

Development Account

↓

Assume Role

↓

Production Account

↓

Deploy Application

Benefits:

  • Centralized identity
  • No shared passwords
  • Better auditing
  • Temporary permissions
  • Strong security

2. Why is Cross Account Access important?

Large enterprises separate workloads into multiple accounts.

Example:

Security

↓

Networking

↓

Development

↓

Production

Without Cross Account Access:

  • Credentials are duplicated
  • Shared accounts appear
  • Poor auditing
  • Increased security risks

Cross Account Access enables secure collaboration while maintaining isolation.

3. What is a Trust Relationship?

A Trust Relationship defines who is allowed to assume a role.

Architecture:

Account A

↓

Trusted

↓

Account B Role

Without a trust relationship:

Access Denied

Trust policies are the foundation of secure cross-account communication.

AWS Cross Account Access

4. How does AWS Cross Account Access work?

AWS uses IAM Roles and AWS Security Token Service (STS).

Flow:

IAM User

↓

AssumeRole

↓

STS

↓

Temporary Credentials

↓

Target Account

Process:

  1. User authenticates.
  2. Calls AssumeRole.
  3. STS verifies trust.
  4. Temporary credentials are issued.
  5. Access expires automatically.

5. What is AssumeRole?

AssumeRole allows a user or service to temporarily obtain another IAM Role.

Example:

Developer

↓

Assume

Production Deployment Role

↓

Deploy

↓

Role Expires

Advantages:

  • Temporary permissions
  • Better auditing
  • Reduced standing privilege
  • Improved security

6. What are Temporary Credentials?

Temporary credentials include:

  • Access Key
  • Secret Key
  • Session Token

Flow:

STS

↓

Temporary Credentials

↓

Application

↓

Access Cloud Resources

Benefits:

  • Automatic expiration
  • Lower risk
  • Easier credential rotation
  • Better compliance

Azure & Google Cloud

7. How is Cross Account Access implemented in Azure?

Azure supports:

  • Cross-Tenant Access
  • Microsoft Entra ID B2B
  • RBAC
  • Conditional Access

Example:

Company A

↓

Microsoft Entra ID

↓

Company B

↓

Azure Resources

Users authenticate using their home organization identity.

8. How does Google Cloud support Cross Account Access?

Google Cloud provides:

  • Workforce Identity Federation
  • Workload Identity Federation
  • IAM Policies
  • Shared VPC
  • Organization Policies

Architecture:

External Identity

↓

Workforce Federation

↓

Google IAM

↓

Cloud Resources

No long-lived service account keys are required.

Kubernetes & Workloads

9. How do Kubernetes workloads access cloud resources securely?

Modern Kubernetes clusters use workload identity instead of static credentials.

Examples:

  • AWS IRSA (IAM Roles for Service Accounts)
  • Azure Workload Identity
  • Google Workload Identity

Flow:

Pod

↓

Service Account

↓

Cloud IAM

↓

Temporary Credentials

↓

Cloud Storage

Benefits:

  • No embedded secrets
  • Automatic credential rotation
  • Better security

10. Why should static credentials be avoided?

Static credentials:

  • Never expire
  • Can leak
  • Require manual rotation
  • Increase attack surface

Bad:

Application

↓

Hardcoded Access Key

Better:

Application

↓

IAM Role

↓

Temporary Credentials

Always prefer short-lived credentials.

Enterprise Security

11. What are common Cross Account Access mistakes?

Common mistakes include:

  • Shared administrator accounts
  • Hardcoded credentials
  • Long-lived access keys
  • Overly permissive trust policies
  • No MFA
  • Excessive permissions
  • Missing audit logs
  • Permanent production access
  • No session expiration

These increase the likelihood of compromise.

12. What are enterprise best practices?

Recommendations:

  • Use IAM Roles
  • Prefer temporary credentials
  • Enable MFA
  • Apply Least Privilege
  • Use approval workflows
  • Enable audit logging
  • Rotate trust relationships
  • Review permissions regularly
  • Avoid shared accounts
  • Monitor AssumeRole activity

Monitoring

13. How should Cross Account Access be monitored?

Monitor:

  • AssumeRole events
  • Failed role assumptions
  • Cross-account API calls
  • Privileged access
  • Session duration
  • Trust policy changes
  • Temporary credential usage
  • Unusual geographic access

Useful tools:

  • AWS CloudTrail
  • Azure Monitor
  • Google Cloud Audit Logs
  • SIEM platforms

Enterprise Architecture

14. How would you design secure multi-account access?

Example:

Identity Provider

↓

MFA

↓

IAM Roles

↓

STS

↓

Temporary Credentials

↓

Development

Testing

Production

↓

Audit Logs

↓

SIEM

Benefits:

  • Strong security
  • Easy auditing
  • Temporary access
  • Centralized identity
  • Least privilege

15. How would you design Cross Account Access in a multi-cloud enterprise?

Architecture:

Employees

↓

Identity Provider
(Okta / Microsoft Entra ID)

↓

Single Sign-On

↓

AWS IAM

Azure RBAC

Google IAM

↓

Temporary Credentials

↓

Applications

↓

Audit Logs

↓

SIEM

Applications:

Kubernetes

↓

Workload Identity

↓

AWS

Azure

Google Cloud

Benefits:

  • Centralized authentication
  • Multi-cloud access
  • Zero Trust
  • No shared credentials
  • Enterprise governance

Production Scenario

Global Financial Enterprise

Requirements:

  • Separate AWS accounts for Dev, QA, and Production.
  • Azure used for Microsoft services.
  • Google Cloud for analytics.
  • Kubernetes workloads access cloud storage.
  • No long-lived credentials.

Architecture:

Employees

↓

Microsoft Entra ID

↓

SSO

↓

AWS AssumeRole

Azure RBAC

Google Workforce Federation

↓

Temporary Credentials

↓

Kubernetes Workload Identity

↓

Applications

↓

Audit Logs

↓

SIEM

Benefits:

  • Centralized identity
  • Secure multi-cloud access
  • No credential sharing
  • Regulatory compliance

Cross Account Architecture

Account A
    │
    ▼
Trust Relationship
    │
    ▼
IAM Role
    │
    ▼
Temporary Credentials
    │
    ▼
Account B

AWS AssumeRole Flow

IAM User

↓

AssumeRole

↓

AWS STS

↓

Temporary Credentials

↓

Target Account

Kubernetes Workload Identity

Pod

↓

Service Account

↓

Cloud IAM

↓

Temporary Credentials

↓

Cloud APIs

Best Practices Checklist

✓ Use IAM Roles Instead of Shared Accounts
✓ Enable Multi-Factor Authentication
✓ Use Temporary Credentials
✓ Implement Least Privilege
✓ Review Trust Relationships Regularly
✓ Avoid Hardcoded Access Keys
✓ Monitor AssumeRole Activity
✓ Enable Audit Logging
✓ Secure Cross-Tenant Access
✓ Use Workforce Identity Federation
✓ Use Workload Identity Federation
✓ Protect Production Accounts
✓ Rotate Credentials Automatically
✓ Integrate with SIEM
✓ Adopt Zero Trust Across Cloud Accounts

Quick Revision

Topic Key Point
Cross Account Access Secure access between cloud accounts
Trust Relationship Defines who may assume a role
AssumeRole Temporary role assumption
AWS STS Issues temporary credentials
Temporary Credentials Short-lived access keys
Azure Cross-Tenant Access Secure identity across tenants
Workforce Identity Federation Employee cross-cloud authentication
Workload Identity Federation Application authentication
Kubernetes Workload Identity Pod-to-cloud authentication
IAM Role Collection of permissions
Least Privilege Minimum required permissions
MFA Strong authentication
Audit Logs Monitor cross-account activity
Zero Trust Verify every access request
Best Practice Temporary credentials with trusted role assumption

Interview Tips

During Cross Account Access interviews:

  • Explain why organizations use multiple cloud accounts (security, billing, environment isolation, compliance).
  • Describe Trust Relationships as the foundation of secure cross-account access.
  • Explain the AWS flow: IAM User → AssumeRole → STS → Temporary Credentials → Target Account.
  • Differentiate temporary credentials from long-lived access keys and explain why temporary credentials are more secure.
  • Compare AWS AssumeRole, Azure Cross-Tenant Access, and Google Workforce/Workload Identity Federation.
  • Discuss Kubernetes Workload Identity as the recommended approach for applications accessing cloud resources without static secrets.
  • Emphasize Least Privilege, MFA, audit logging, Zero Trust, and SIEM integration as enterprise best practices.

Summary

Cross Account Access enables secure communication between cloud accounts using trusted identities and temporary credentials.

Key concepts include:

  • Cross Account Access
  • Trust Relationships
  • IAM Roles
  • AssumeRole
  • AWS STS
  • Temporary Credentials
  • Azure Cross-Tenant Access
  • Workforce Identity Federation
  • Workload Identity Federation
  • Kubernetes Workload Identity
  • Least Privilege
  • Multi-Factor Authentication (MFA)
  • Audit Logging
  • Zero Trust
  • Enterprise Multi-Cloud Security

Mastering these 15 Cross Account Access interview questions prepares you for Cloud Engineer, DevOps Engineer, Security Engineer, IAM Engineer, Platform Engineer, Site Reliability Engineer (SRE), Technical Lead, Solution Architect, and Enterprise Architect interviews.