nerdexam
Amazon

SAP-C02 · Question #500

A company is migrating its development and production workloads to a new organization in AWS Organizations. The company has created a separate member account for development and a separate member…

The correct answer is D. Create an IAM user in the management account. In the member accounts, create cross-account. To enable an IAM user in the management account to stop or terminate resources in member accounts, create cross-account roles in each member account that the management account user can assume, granting the necessary permissions.

Submitted by takeshi77· Mar 6, 2026Design Solutions for Organizational Complexity

Question

A company is migrating its development and production workloads to a new organization in AWS Organizations. The company has created a separate member account for development and a separate member account for production. Consolidated billing is linked to the management account. In the management account, a solutions architect needs to create an IAM user that can stop or terminate resources in both member accounts. Which solution will meet this requirement?

Options

  • ACreate an IAM user and a cross-account role in the management account. Configure the cross-
  • BCreate an IAM user in each member account. In the management account, create a cross-
  • CCreate an IAM user in the management account. In the member accounts, create an IAM group
  • DCreate an IAM user in the management account. In the member accounts, create cross-account

How the community answered

(56 responses)
  • A
    5% (3)
  • B
    9% (5)
  • C
    16% (9)
  • D
    70% (39)

Why each option

To enable an IAM user in the management account to stop or terminate resources in member accounts, create cross-account roles in each member account that the management account user can assume, granting the necessary permissions.

ACreate an IAM user and a cross-account role in the management account. Configure the cross-

Cross-account roles are created in the *target* accounts (member accounts) that the source user wishes to access, not in the source (management) account, and the policy alone without a role won't grant access.

BCreate an IAM user in each member account. In the management account, create a cross-

The requirement specifies a single IAM user in the *management account* to access both member accounts, not separate IAM users created in each member account.

CCreate an IAM user in the management account. In the member accounts, create an IAM group

IAM groups are local to an AWS account; an IAM user from a different account (the management account) cannot directly join an IAM group in a member account to gain cross-account permissions.

DCreate an IAM user in the management account. In the member accounts, create cross-accountCorrect

The correct solution involves creating an IAM user in the management account, and then in each member account (development and production), creating separate cross-account IAM roles. Each of these roles must have a trust policy configured to allow the specific IAM user from the management account to assume it, and an attached IAM policy granting the necessary permissions (e.g., stop/terminate resources) within that respective member account.

Concept tested: Cross-account access, IAM roles, AWS Organizations

Source: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user.html

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full SAP-C02 Practice