SAA-C03 Question 15
Single answerA company has multiple AWS accounts that are part of an AWS Organizations setup. The company wants to centrally manage access for developers to specific resources across these accounts without having to create IAM users in each account. What is the MOST appropriate solution?
- A
Use AWS Systems Manager Parameter Store to share access policies across accounts.
- B
Set up AWS Single Sign-On (AWS SSO) to manage access centrally and grant permissions to resources in member accounts.
- C
Create IAM roles in each account and manually distribute the credentials to developers.
- D
Enable cross-account resource sharing using Resource Access Manager (RAM) and rely on IAM users for access management.
Show answer and explanation
Correct answer: B
Explanation
AWS Single Sign-On (AWS SSO) provides a centralized way to manage access across multiple AWS accounts within AWS Organizations. It eliminates the need for creating and managing individual IAM users in each account and provides a scalable solution for controlling access to resources. The other options either do not address the centralized access management requirement or are not recommended practices.
- A. Incorrect.
AWS Systems Manager Parameter Store is used for securely storing configuration data and secrets, not for managing access controls across accounts.
- B. Correct.
AWS Single Sign-On (AWS SSO) is the most appropriate solution. It allows centralized access management across multiple AWS accounts in an organization and integrates with permission sets to grant access to resources in member accounts.
- C. Incorrect.
Creating IAM roles in each account and manually distributing credentials is not scalable or secure. AWS recommends avoiding manual credential sharing.
- D. Incorrect.
AWS Resource Access Manager (RAM) is used for sharing resources like subnets and transit gateways across accounts, but it does not provide centralized access control for users.