A company uses an organization in AWS Organizations to manage multiple AWS accounts. The company's internal auditors have administrative access to a single audit account within the organization. A…

AWS IAM Identity Center manages centralized access for users and groups, but the problem implies auditors need to assume a role from an existing administrative AWS account, which is better handled by cross-account roles and Stack Sets for provisioning. Identity Center involves a different identity and access management flow.

AWS CloudFormation Stack Sets are designed to deploy AWS resources, such as IAM roles, consistently across multiple accounts and Organizational Units (OUs) within an AWS Organization. By defining an IAM role with read-only permissions and a trust policy that allows the dedicated audit account to assume it, Stack Sets ensure this role is present in all target accounts, including new ones added to the OU, enabling comprehensive read-only access with minimal management.

Service Control Policies (SCPs) are guardrails that define maximum permissions and restrict actions within an organization; they do not grant explicit permissions. An IAM policy attached to a role is required to grant read-only access.

AWS Config monitors resource compliance and configuration, but it is not a tool for provisioning or granting access to resources across an organization.