SAA-C03 Question 13
Single answerA company has multiple AWS accounts that are used for different departments such as Finance, Development, and Operations. They want to centrally manage access controls to ensure that users can only access resources in their respective accounts, while also enabling centralized billing and monitoring. Which AWS service or feature should they use to achieve this?
- A
AWS Organizations with Service Control Policies (SCPs)
- B
AWS Identity and Access Management (IAM) Roles only
- C
Amazon S3 Cross-Account Access
- D
AWS Resource Access Manager (RAM)
Show answer and explanation
Correct answer: A
Explanation
AWS Organizations is the recommended service for managing multiple accounts in a centralized manner. With SCPs, you can define permissions at the organization or account level, ensuring consistent and secure access management. It also integrates with consolidated billing and other governance features, making it the best fit for this scenario.
- A. Correct.
Correct. AWS Organizations with Service Control Policies (SCPs) allow centralized management of access controls across multiple AWS accounts. SCPs help define permissions that are enforced at the account level, ensuring compliance and security.
- B. Incorrect.
Incorrect. While IAM roles are useful for granting access within or across accounts, they do not provide centralized access management across multiple accounts. They are used in conjunction with other services like AWS Organizations.
- C. Incorrect.
Incorrect. Amazon S3 Cross-Account Access is specific to sharing S3 resources between accounts, but it does not provide centralized access management across multiple accounts.
- D. Incorrect.
Incorrect. AWS Resource Access Manager (RAM) is used for sharing specific resources across accounts, such as VPC subnets or Transit Gateways, but it does not provide centralized access controls or billing.