A company uses AWS Organizations and has AWS IAM Identity Center (AWS Single Sign-On) and AWS Control Tower configured. The company must manage multiple user permissions across accounts, split permissions between developer and administrator teams, and add new hires to the teams. Which solution meets these requirements with the LEAST operational overhead?
Choose an answer
Tap an option to check your answer.
Correct answer: Create individual users in IAM Identity Center. Create new developer and administrator groups in IAM Identity Center. Create new permission sets that include the appropriate IAM policies for each group. Assign the new groups to the appropriate accounts. Assign the new permission sets to the new groups. When new users are hired, add them to the appropriate group..
Why this is the answer
The correct solution leverages IAM Identity Center's core features for centralized identity and access management across multiple accounts, which is ideal for AWS Organizations and Control Tower environments. Creating users, groups, and permission sets in IAM Identity Center allows for scalable and efficient management. New hires are simply added to the relevant group, inheriting all necessary permissions. Permission sets define specific access levels (e.g., developer, administrator) and are assigned to groups, not individual users, reducing administrative overhead. Incorrect options: Creating individual users in IAM Identity Center for each account is redundant and increases overhead. IAM Identity Center manages users centrally across all accounts. Attaching custom IAM policies directly
Pass your exam — without the endless answer hunt
Get every verified question and explanation for this exam in one place, and save hours of prep. 1,000+ certifications · 20+ languages · free to start.
Pass your exam faster → No card needed