SCS-C02 Question 429
Single answerYour organization uses AWS Organizations to manage multiple AWS accounts. The Security team wants to delegate administrative access for managing IAM Identity Center (formerly AWS SSO) to the DevOps team for a specific account. Which managed service should you use to enable this delegation effectively while following security best practices?
- A
AWS Resource Access Manager (RAM)
- B
AWS Identity Center Delegated Administration
- C
Service Control Policies (SCPs)
- D
AWS CloudFormation StackSets
Show answer and explanation
Correct answer: B
Explanation
AWS Identity Center Delegated Administration allows you to delegate administrative access to manage IAM Identity Center to a specific account while maintaining centralized control within the AWS Organization. This is the best approach to achieve secure and scalable permission delegation for IAM Identity Center management in a multi-account environment.
- A. Incorrect.
AWS Resource Access Manager (RAM) is used for sharing AWS resources across accounts or organizations but does not handle delegated administration or IAM Identity Center permissions management.
- B. Correct.
AWS Identity Center Delegated Administration is the correct service for delegating administrative access to manage IAM Identity Center. It allows you to designate a specific account to manage IAM Identity Center for other accounts within your organization.
- C. Incorrect.
Service Control Policies (SCPs) are used to enforce permissions boundaries at the account or organizational unit level but are not used for delegating administrative access to a specific service like IAM Identity Center.
- D. Incorrect.
AWS CloudFormation StackSets enables you to deploy infrastructure as code across multiple accounts and regions but does not provide delegated administrative access for managing services like IAM Identity Center.