SCS-C02 Question 424
Select 2Your company has adopted a multi-account AWS strategy to isolate workloads for better security and management. You have been tasked with designing a secure way to manage cross-account access for a team of developers who need to access specific resources in multiple accounts. Which of the following approaches should you implement?
- A
Use AWS Organizations and create Service Control Policies (SCPs) to grant developers cross-account access.
- B
Set up IAM roles in each account and allow developers to assume these roles using their IAM user credentials from a central account.
- C
Enable AWS Resource Access Manager (RAM) to share resources across accounts and assign resource permissions directly to the developers.
- D
Leverage AWS Single Sign-On (SSO) to create groups and permissions centrally, allowing developers to access accounts with temporary credentials.
- E
Create VPC peering connections across accounts and use security groups to manage developer access.
Show answer and explanation
Correct answers: B, D
Explanation
For securely managing cross-account access in a multi-account AWS environment, leveraging IAM roles and AWS SSO are the best practices. IAM roles allow developers to assume permissions in target accounts without creating users in each account, while AWS SSO provides centralized user and permission management, making it scalable and secure. SCPs, RAM, and VPC peering are not suitable for managing individual developer access to resources across accounts.
- A. Incorrect.
Service Control Policies (SCPs) control the maximum permissions an account's IAM policies can grant but do not directly enable cross-account access for specific developers.
- B. Correct.
Using IAM roles is a recommended method for enabling secure cross-account access. Developers can assume roles in target accounts and gain temporary permissions without directly creating users in each account.
- C. Incorrect.
AWS Resource Access Manager (RAM) is designed for sharing resources like subnets or license configurations but does not handle individual developer access management.
- D. Correct.
AWS Single Sign-On (SSO) simplifies multi-account access management by centralizing user permissions and providing temporary credentials, making it a secure and scalable solution.
- E. Incorrect.
VPC peering is used for network connectivity between accounts but is unrelated to managing developer access to resources in a secure manner.