SAP-C02 Question 51
Select 3Your organization has implemented AWS IAM Identity Center (AWS Single Sign-On) to manage access to multiple AWS accounts. The security team requires that users are granted the least privilege permissions to resources, and access should be granted based on their department. Additionally, you need to enforce a centralized way to audit who accessed which resources across all accounts. What steps should you take to meet these requirements?
- A
Define permission sets in AWS IAM Identity Center, map them to department-specific roles, and assign them to users or groups.
- B
Enable AWS CloudTrail across all AWS accounts to track and audit access to resources.
- C
Manually create IAM roles in each AWS account and assign them directly to individual users.
- D
Set up attribute-based access control (ABAC) with IAM policies to dynamically grant access based on user attributes defined in AWS IAM Identity Center.
- E
Disable AWS IAM Identity Center and use IAM users to manage access for individual accounts.
Show answer and explanation
Correct answers: A, B, D
Explanation
To meet the requirements, you need to use AWS IAM Identity Center's permission sets to assign least privilege access based on departments and use attribute-based access control (ABAC) for dynamic permissions. AWS CloudTrail is necessary for centralized auditing to track access across accounts. Manually managing IAM roles or reverting to IAM users would contradict the goal of centralized, scalable, and secure access management.
- A. Correct.
This is correct. AWS IAM Identity Center allows you to define permission sets, which are collections of policies for specific access levels, and map them to roles based on departments. This ensures least privilege access.
- B. Correct.
This is correct. AWS CloudTrail enables auditing and tracking of user activities across multiple AWS accounts, which satisfies the centralized auditing requirement.
- C. Incorrect.
This is incorrect. Manually creating IAM roles in each account and assigning them to individual users does not align with centralized management or the use of AWS IAM Identity Center.
- D. Correct.
This is correct. Attribute-based access control (ABAC) allows you to dynamically grant access based on user attributes (e.g., department), ensuring scalability and simplified permission management.
- E. Incorrect.
This is incorrect. Disabling AWS IAM Identity Center and using IAM users would contradict the centralized access management goal and make managing multiple accounts more complex.