SAA-C03 Question 16
Single answerA company has multiple AWS accounts managed under a single AWS Organization. They want to implement centralized access management for users across all accounts while minimizing administrative overhead. Which approach should they take?
- A
Create IAM users in each account and grant them appropriate permissions.
- B
Use AWS Single Sign-On (AWS SSO) to manage access and permissions centrally for all accounts.
- C
Set up cross-account IAM roles in each account and share the credentials with users.
- D
Use AWS Resource Access Manager (AWS RAM) to manage user access across accounts.
Show answer and explanation
Correct answer: B
Explanation
The company requires centralized access management for users across multiple AWS accounts while minimizing administrative overhead. AWS Single Sign-On (AWS SSO) is specifically designed to provide centralized user access management for AWS Organizations, making it the most suitable solution for this scenario.
- A. Incorrect.
Creating IAM users in each account increases administrative overhead and does not provide centralized management, which is against the requirements of the scenario.
- B. Correct.
AWS Single Sign-On (AWS SSO) allows centralized management of access and permissions for users across multiple AWS accounts under an AWS Organization, fulfilling both the access management and administrative simplicity requirements.
- C. Incorrect.
Cross-account IAM roles are used for resource sharing or temporary access but do not provide centralized access management. Sharing credentials is also not a secure practice.
- D. Incorrect.
AWS Resource Access Manager (AWS RAM) is used for sharing resources across accounts but does not handle user access management.