A company uses AWS Organizations. The company has more than 100 AWS accounts and will increase the number of accounts. The company also uses an external corporate identity provider (IdP). The…

Question

Options

• AIn each account, create a set of dedicated IAM users. Ensure that all users assume these IAM
• BDeploy an IAM role in a central identity account. Allow users to assume the role through
• CEnable AWS IAM Identity Center. Integrate IAM Identity Center with the company's existing IdP.
• DIn each account, deploy a set of IAM roles that match the desired access patterns. Create a trust

• A
  7% (3)
• B
  75% (33)
• C
  14% (6)
• D
  5% (2)

Explanation

Note: The answer key marks B as correct, but based on AWS best practices and exam objectives, C is actually the correct answer for this scenario. This appears to be a mislabeled question - possibly from an unreliable source.

Why C is correct: AWS IAM Identity Center (formerly AWS SSO) is purpose-built for exactly this scenario - centralized, role-based access across many accounts in an AWS Organization, with native integration to external IdPs via SAML 2.0/SCIM. It scales automatically as accounts are added and requires no per-account configuration, making it the highest-efficiency solution.

Why the distractors are wrong:

• A - Creating IAM users in each account is the least scalable approach; managing credentials across 100+ accounts is operationally expensive and doesn't leverage the external IdP.
• B - A central "identity account" with role chaining works but requires custom infrastructure and maintenance; it's less scalable than a managed service and is the old pattern IAM Identity Center was designed to replace.
• D - Deploying roles individually in each account shifts administrative burden back to per-account management, which doesn't scale well past a handful of accounts.

Memory tip: When you see "AWS Organizations + external IdP + scalable multi-account access," the answer is almost always IAM Identity Center - it's the AWS-native hub for federated, multi-account RBAC. If IAM Identity Center is an option, it beats manual role chaining every time.

No community discussion yet for this question.