Q8 — AWS SAA-C03 Ch.12

Question 8 of 100 | ← Chapter 12

Q808. A solutions architect is designing an AWS Identity and Access Management (IAM) authorization model for a company's AWS account. The company has designated five specific employees to have full access to AWS services and resources in the AWS account.The solutions architect has created an IAM user for each of the five designated employees and has created an IAM user group.Which solution will meet these requirements?

• A. Attach the AdministratorAccess resource-based policy to the IAM user group. Place each of the five designated employee IAM users in the IAM user group.
• B. Attach the SystemAdministrator identity-based policy to the IAM user group. Place each of the five designated employee IAM users in the IAM user group.
• C. Attach the AdministratorAccess identity-based policy to the IAM user group. Place each of the five designated employee IAM users in the IAM user group. ✓
• D. Attach the SystemAdministrator resource-based policy to the IAM user group. Place each of the five designated employee IAM users in the IAM user group.

Correct Answer: C. Attach the AdministratorAccess identity-based policy to the IAM user group. Place each of the five designated employee IAM users in the IAM user group.

Explanation

To meet the requirement of granting full access to AWS services and resources in the AWS account to five designated employees using an IAM user group, the recommended solution is:C. Attach the AdministratorAccess identity-based policy to the IAM user group. Place each of the five designated employee IAM users in the IAM user group.Option C provides the most suitable solution for granting full access to the five designated employees:\1. The AdministratorAccess policy is an AWS managed policy that provides full administrative access to AWS services and resources in the account.\2. Attaching the AdministratorAccess identity-based policy directly to the IAM user group ensures that all IAM users within the group inherit the policy's permissions.By creating an IAM user group and attaching the AdministratorAccess identity-based policy to it, the solutions architect can grant full access to the designated employees while simplifying the management of permissions.Here's why the other options are not the best fit for the given requirements:A. Attaching the AdministratorAccess resource-based policy to the IAM user group: Resource-based policies are used to grant permissions for accessing specific resources, such as S3 buckets or Lambda functions. They are not used to grant administrative access to AWS services and resources at the account level.B. Attaching the SystemAdministrator identity-based policy to the IAM user group: The SystemAdministrator policy is not an AWS managed policy and may not provide the necessary level of permissions required for full administrative access.D. Attaching the SystemAdministrator resource-based policy to the IAM user group: Similar to option B, the SystemAdministrator policy is not an AWS managed policy and may not provide the required permissions for full administrative access.Therefore, the recommended solution for granting full access to the AWS services and resources in the AWS account to the five designated employees using an IAM user group is:C. Attach the AdministratorAccess identity-based policy to the IAM user group. Place each of the five designated employee IAM users in the IAM user group.