SCS-C02 Question 428
Single answerYour company uses AWS Organizations to manage multiple AWS accounts. The Security Team needs to delegate administrative tasks for AWS Identity and Access Management (IAM) Access Analyzer to a specific team in one of your AWS accounts, without granting them full administrative access to the organization's management account. Which AWS service feature would you use to accomplish this?
- A
Enable Service-Linked Roles for IAM Access Analyzer in the organization's management account
- B
Use Delegated Administrator for IAM Access Analyzer in AWS Organizations
- C
Create a cross-account IAM role in the organization's management account and grant permissions to the specific team
- D
Grant the specific team full access to the AWS Organizations management account
Show answer and explanation
Correct answer: B
Explanation
The Delegated Administrator feature in AWS Organizations is specifically designed to allow the delegation of administrative tasks for certain AWS services to a member account. This approach adheres to the principle of least privilege and avoids granting unnecessary access to the organization's management account, making it the most secure and efficient solution for this scenario.
- A. Incorrect.
Service-linked roles are used by AWS services to perform actions on your behalf, but they do not allow delegation of administrative tasks to other accounts or teams.
- B. Correct.
Delegated Administrator allows you to assign administrative responsibilities for specific AWS services, such as IAM Access Analyzer, to member accounts within AWS Organizations, enabling fine-grained delegation without granting full access to the management account.
- C. Incorrect.
While a cross-account IAM role could grant permissions, this approach is not aligned with AWS best practices for delegation using managed services like AWS Organizations' Delegated Administrator feature.
- D. Incorrect.
Granting full access to the AWS Organizations management account is overly broad and violates the principle of least privilege, making it an insecure and unsuitable solution.