Q9 — AWS SAA-C03 Ch.16

Question 9 of 100 | ← Chapter 16

Q1209. A company is using AWS Identity and Access Management Access Analyzer to refine IAM permissions for employee users. The company uses an organization in AWS Organizations and AWS Control Tower to manage its AWS accounts. The company has designated a specific member account as an audit account.A solutions architect needs to set up IAM Access Analyzer to aggregate findings from all member accounts in the audit account.What is the first step the solutions architect should take?

• A. Use AWS CloudTrail to configure one trail for all accounts. Create an Amazon S3 bucket in the audit account. Configure the trail to send events related to access activity to the new S3 bucket in the audit account.
• B. Configure a delegated administrator account for IAM Access Analyzer in the AWS Control Tower management account.In the delegated administrator account for IAM Access Analyzer, specify the AWS account ID of the audit account. ✓
• C. Create an Amazon S3 bucket in the audit account. Generate a new permissions policy,and add a service role to the policy to give IAM Access Analyzer access to AWS CloudTrail and the S3 bucket in the audit account.
• D. Add a new trust policy that includes permissions to allow IAM Access Analyzer to perform sts:AssumeRole actions.Modify the permissions policy to allow IAM Access Analyzer to generate policies.

Correct Answer: B. Configure a delegated administrator account for IAM Access Analyzer in the AWS Control Tower management account.In the delegated administrator account for IAM Access Analyzer, specify the AWS account ID of the audit account.

Explanation

To set up IAM Access Analyzer to aggregate findings from all member accounts in the audit account, the first step the solutions architect should take is:B. Configure a delegated administrator account for IAM Access Analyzer in the AWS Control Tower management account. In the delegated administrator account for IAM Access Analyzer, specify the AWS account ID of the audit account.Analysis:Delegated Administrator for IAM Access Analyzer:Centralized Management: AWS Organizations and AWS Control Tower allow you to designate a delegated administrator for certain services, including IAM Access Analyzer. By configuring a delegated administrator account, you can centralize the management of IAM Access Analyzer across all member accounts in your organization.Audit Account Specification: In the delegated administrator account, you can specify the AWS account ID of the audit account. This ensures that IAM Access Analyzer findings from all member accounts are aggregated in the designated audit account, providing a centralized view of IAM permissions and potential security issues.Why Other Options Are Not Suitable:A. Use AWS CloudTrail to Configure One Trail for All Accounts:CloudTrail vs. IAM Access Analyzer: While AWS CloudTrail is useful for logging and monitoring API calls across your AWS accounts, it is not directly related to setting up IAM Access Analyzer to aggregate findings. IAM Access Analyzer focuses on analyzing IAM policies and identifying potential security risks, whereas CloudTrail provides a detailed audit trail of API activity. C. Create an Amazon S3 Bucket in the Audit Account and Generate a New Permissions Policy:Premature Step: Creating an S3 bucket and generating a permissions policy is a necessary step for storing IAM Access Analyzer findings, but it is not the first step in setting up IAM Access Analyzer to aggregate findings from all member accounts. The first step should be to configure the delegated administrator account and specify the audit account.D. Add a New Trust Policy and Modify the Permissions Policy:Trust Policy and Permissions Policy: While trust policies and permissions policies are important for granting IAM Access Analyzer the necessary permissions to perform its tasks, they are not the first step in setting up IAM Access Analyzer to aggregate findings from all member accounts. The initial step should focus on configuring the delegated administrator account and specifying the audit account.