SCS-C02 Question 279
Single answerA company is designing a multi-account AWS environment and wants to ensure that administrators in the central security account can manage IAM policies across all linked accounts. Which solution allows secure and scalable cross-account access for this requirement?
- A
Use AWS Organizations with Service Control Policies (SCPs) to manage IAM policies across all accounts.
- B
Establish an IAM role in each linked account with a trust relationship to the central security account.
- C
Enable AWS SSO and use it to assign permissions to IAM policies in the linked accounts.
- D
Use resource-based policies in each linked account to allow access from the central security account.
Show answer and explanation
Correct answer: B
Explanation
To enable secure and scalable cross-account access for managing IAM policies, creating IAM roles in each linked account with a trust relationship to the central security account is the best solution. This allows administrators in the central account to assume roles and perform necessary actions across accounts. Other options like SCPs or resource-based policies are either not designed for this use case or lack the necessary functionality.
- A. Incorrect.
Service Control Policies (SCPs) in AWS Organizations are used to define guardrails and restrict actions at the account or organizational unit level, but they do not manage individual IAM policies.
- B. Correct.
Creating an IAM role in each linked account, with a trust relationship to the central security account, allows administrators in the central account to assume those roles and manage IAM policies effectively. This is a scalable and secure solution for cross-account access.
- C. Incorrect.
AWS SSO is used for managing user access and permissions centrally but does not directly facilitate cross-account IAM policy management.
- D. Incorrect.
Resource-based policies allow specific resources (e.g., S3 buckets) to be accessed by principals in other accounts, but they are not suitable for managing IAM policies across accounts.