Q93 — AWS SAA-C03 Ch.12

Question 93 of 100 | ← Chapter 12

Q893. A company has two AWS accounts: Production and Development. The company needs to push code changes in the Development account to the Production account. In the alpha phase, only two senior developers on the development team need access to the Production account. In the beta phase, more developers will need access to perform testing.Which solution will meet these requirements?

• A. Create two policy documents by using the AWS Management Console in each account. Assign the policy to developers who need access.
• B. Create an IAM role in the Development account. Grant the IAM role access to the Production account.Allow developers to assume the role.
• C. Create an IAM role in the Production account. Define a trust policy that specifies the Development account. Allow developers to assume the role.
• D. Create an IAM group in the Production account. Add the group as a principal in a trust policy that specifies the Production account. Add developers to the group. ✓

Correct Answer: D. Create an IAM group in the Production account. Add the group as a principal in a trust policy that specifies the Production account. Add developers to the group.

Explanation

By creating an IAM group in the Production account and adding it as a principal in a trust policy that specifies the Production account, you can control access to the Production account. The trust policy establishes a trust relationship within the same account, allowing the IAM group to assume roles or access resources in the Production account.During the alpha phase, only two senior developers on the development team need access to the Production account. You can add these developers to the IAM group, which will have the necessary permissions to perform code deployments or access resources in the Production account.In the beta phase, when more developers need access to perform testing, you can add them to the same IAM group. This allows you to scale access to the Production account by simply adding developers to the group.Option A suggests creating separate policy documents in each account and assigning them to individual developers who need access. This approach can become cumbersome to manage as the number of developers increases and doesn't provide a scalable solution for managing access during different phases.Option B suggests creating an IAM role in the Development account and granting it access to the Production account. While this approach allows for cross-account access, it does not address the requirement of limiting access during different phases or provide a scalable approach for managing access.Option C suggests creating an IAM role in the Production account with a trust policy that specifies the Development account. However, this approach doesn't align with the requirement of granting access to the Production account based on different phases or provide a scalable solution for managing access.In summary, to meet the requirements of granting access to the Production account for code deployment, with limited access during the alpha phase and expanded access during the beta phase, creating an IAM group in the Production account and adding it as a principal in a trust policy that specifies the Production account (Option D) is the appropriate solution.