A company wants to centrally manage its employee's access to multiple AWS accounts. Which AWS service or feature should the company use to meet this requirement?

Question

Options

• AAWS Identity and Access Management Access Analyzer
• BAWS Secrets Manager
• CAWS IAM Identity Center
• DAWS Security Token Service (AWS STS)

• B
  3% (1)
• C
  92% (34)
• D
  5% (2)

Explanation

AWS IAM Identity Center (formerly AWS Single Sign-On) is purpose-built for centrally managing user access across multiple AWS accounts from a single place, making it the ideal solution for this scenario. It allows administrators to define permission sets and assign them to users or groups across an entire AWS Organization, providing a unified identity management experience.

Why the distractors are wrong:

• A. IAM Access Analyzer identifies unintended resource access and analyzes policies for security findings - it doesn't manage user access across accounts.
• B. AWS Secrets Manager securely stores and rotates credentials like database passwords and API keys - it's not for managing employee identity access.
• D. AWS STS generates temporary security credentials programmatically - it's a building block used behind the scenes, not a centralized access management solution in itself.

Memory Tip: Think of IAM Identity Center = "One front door for all your AWS accounts." The word "Center" in the name literally implies centralization - if an exam question mentions centrally managing access across multiple accounts or applications, IAM Identity Center is almost always the answer.

No community discussion yet for this question.