DOP-C02 · Question #63
A company has an organization in AWS Organizations. The organization includes workload accounts that contain enterprise applications. The company centrally manages users from an operations account. No
The correct answer is B. Create a SysAdmin role in each workload account. Attach the AdministratorAccess policy to the D. In the operations account, create an IAM user for each operations team member. E. In the operations account, create an IAM user group that is named SysAdmins. Add an IAM policy. Any thing Cognito, safe to remove (it is only used for application identity management) Step 1: Create each role in each workload account. Set trust relationship to only sts:AssumeRole via the operations user in operations account Step 2: Self explanatory: whatever permission you
Question
A company has an organization in AWS Organizations. The organization includes workload accounts that contain enterprise applications. The company centrally manages users from an operations account. No users can be created in the workload accounts. The company recently added an operations team and must provide the operations team members with administrator access to each workload account. Which combination of actions will provide this access? (Choose three.)
Options
- ACreate a SysAdmin role in the operations account. Attach the AdministratorAccess policy to the
- BCreate a SysAdmin role in each workload account. Attach the AdministratorAccess policy to the
- CCreate an Amazon Cognito identity pool in the operations account. Attach the SysAdmin role as
- DIn the operations account, create an IAM user for each operations team member.
- EIn the operations account, create an IAM user group that is named SysAdmins. Add an IAM policy
- FCreate an Amazon Cognito user pool in the operations account. Create an Amazon Cognito user
How the community answered
(39 responses)- A5% (2)
- B62% (24)
- C10% (4)
- F23% (9)
Explanation
Any thing Cognito, safe to remove (it is only used for application identity management) Step 1: Create each role in each workload account. Set trust relationship to only sts:AssumeRole via the operations user in operations account Step 2: Self explanatory: whatever permission you needs once the user assumed the role
Topics
Community Discussion
No community discussion yet for this question.