Q73 — AWS SAA-C03 Ch.11

Question 73 of 100 | ← Chapter 11

Q773. A company manages AWS accounts in AWS Organizations. AWS IAM Identity Center (AWS Single Sign- On) and AWS Control Tower are configured for the accounts. The company wants to manage multiple user permissions across all the accounts.The permissions will be used by multiple IAM users and must be split between the developer and administrator teams. Each team requires different permissions. The company wants a solution that includes new users that are hired on both teams.Which solution will meet these requirements with the LEAST operational overhead?

• A. Create individual users in IAM Identity Center for each account. Create separate developer and administrator groups in IAM Identity Center. Assign the users to the appropriate groups. Create a custom IAM policy for each group to set fine-grained permissions.
• B. Create individual users in IAM Identity Center for each account. Create separate developer and administrator groups in IAM Identity Center. Assign the users to the appropriate groups. Attach AWS managed IAM policies to each user as needed for fine-grained permissions.
• C. Create individual users in IAM Identity Center. Create new developer and administrator groups in IAM Identity Center. Create new permission sets that include the appropriate IAM policies for each group.Assign the new groups to the appropriate accounts. Assign the new permission sets to the new groups.When new users are hired, add them to the appropriate group. ✓
• D. Create individual users in IAM Identity Center. Create new permission sets that include the appropriate IAM policies for each user. Assign the users to the appropriate accounts. Grant additional IAM permissions to the users from within specific accounts. When new users are hired, add them to IAM Identity Center and assign them to the accounts.

Correct Answer: C. Create individual users in IAM Identity Center. Create new developer and administrator groups in IAM Identity Center. Create new permission sets that include the appropriate IAM policies for each group.Assign the new groups to the appropriate accounts. Assign the new permission sets to the new groups.When new users are hired, add them to the appropriate group.

Explanation

To meet the requirements of managing multiple user permissions across AWS accounts in the least operational overhead, the most suitable solution is:C. Create individual users in IAM Identity Center. Create new developer and administrator groups in IAM Identity Center. Create new permission sets that include the appropriate IAM policies for each group. Assign the new groups to the appropriate accounts. Assign the new permission sets to the new groups. When new users are hired, add them to the appropriate group.Option C provides a scalable and efficient solution with the least operational overhead:Create individual users in IAM Identity Center:By creating individual users in IAM Identity Center (AWS Single Sign-On), you can centrally manage user identities and access across multiple accounts.Create new developer and administrator groups in IAM Identity Center:Creating separate developer and administrator groups allows you to easily assign appropriate permissions to each team.Create new permission sets that include the appropriate IAM policies for each group:Permission sets in IAM Identity Center allow you to define sets of IAM policies that can be assigned to groups. By creating separate permission sets for the developer and administrator groups, you can define and manage the required permissions for each team.Assign the new groups to the appropriate accounts:Assigning the developer and administrator groups to the respective accounts ensures that the teams have access to the appropriate resources.Assign the new permission sets to the new groups:Assigning the permission sets to the developer and administrator groups ensures that the teams have the necessary permissions defined by the policies in the permission sets.When new users are hired, add them to the appropriate group:Adding new users to the appropriate developer or administrator group allows them to inherit the permissions defined by the group's permission set, reducing the administrative overhead.Here's why the other options are not the most suitable choices:Option A suggests creating individual users in IAM Identity Center and separate developer and administrator groups. However, it requires creating custom IAM policies for each group to set fine-grained permissions. Managing individual policies for each group can lead to increased operational overhead.Option B suggests attaching AWS managed IAM policies to each user as needed for fine-grained permissions. While it provides some level of flexibility, it requires managing and attaching multiple IAM policies to each user, which can result in increased administrative effort and complexity.Option D suggests creating new permission sets for each user and assigning them to the appropriate accounts. Granting additional IAM permissions to users from within specific accounts can lead to a fragmented and less centralized approach to managing permissions, resulting in higher operational overhead.Therefore, the most appropriate solution to manage multiple user permissions across AWS accounts with the least operational overhead is:C. Create individual users in IAM Identity Center. Create new developer and administrator groups in IAM Identity Center. Create new permission sets that include the appropriate IAM policies for each group. Assign the new groups to the appropriate accounts. Assign the new permission sets to the new groups. When new users are hired, add them to the appropriate group.