A company wants to allow its DevOps teams to create IAM roles within their own AWS accounts. However, IT security policy mandates that no team-created role can have administrative-level permissions…

Question

Options

• AUse an organization in AWS Organizations to manage the DevOps team accounts. Create a
• BUse an organization in AWS Organizations to manage the DevOps team accounts. Create a
• CAllow full AWS IAM permissions in team AWS accounts. Create AWS Config rules to alert
• DCreate an IAM policy that denies users the permissions to create IAM roles with policies that

• A
  3% (1)
• B
  83% (24)
• C
  3% (1)
• D
  10% (3)

Explanation

Using a service control policy (SCP) that enforces a permissions boundary ensures that DevOps teams can create IAM roles but cannot grant administrative-level permissions. Attaching the SCP at the organizational unit level provides centralized enforcement across all team accounts with minimal operational overhead.

No community discussion yet for this question.