SCS-C02 Question 431
Single answerYour organization uses AWS Organizations to manage multiple AWS accounts. The Security team wants to delegate the management of AWS Identity and Access Management (IAM) Access Analyzer findings to the Compliance team without giving them full administrative access to the master account. Which service or feature should you use to achieve this?
- A
AWS Resource Access Manager (RAM)
- B
Delegated Administrator in AWS Organizations
- C
AWS Service Catalog
- D
AWS Config Aggregator
Show answer and explanation
Correct answer: B
Explanation
AWS Organizations allows the master account to delegate administrative privileges for certain AWS services to member accounts using the Delegated Administrator feature. This enables the Compliance team to manage IAM Access Analyzer findings without requiring direct access to the master account, ensuring a secure and efficient delegation of responsibilities.
- A. Incorrect.
AWS Resource Access Manager (RAM) allows you to share AWS resources across accounts but does not provide the ability to delegate administrative privileges for specific services to another account.
- B. Correct.
Delegated Administrator in AWS Organizations allows you to delegate the management of specific AWS services to another account within your organization. This is the correct solution in this scenario to allow the Compliance team to manage IAM Access Analyzer findings without requiring access to the master account.
- C. Incorrect.
AWS Service Catalog is used to create and manage catalogs of approved IT resources but is not related to delegating administrative tasks within AWS Organizations.
- D. Incorrect.
AWS Config Aggregator helps you aggregate AWS Config data from multiple accounts and regions but does not provide a mechanism to delegate administrative control over AWS services.