SCS-C02 · Question #474
A company has hundreds of AWS accounts and uses AWS Organizations. The company plans to create many different IAM roles and policies for its product team, security team, and platform team. Some IAM…
The correct answer is A. Set up an IAM path with the IAM roles for each team. Deploy an SCP that denies the. Using IAM paths allows you to organize and logically group IAM roles by team, making it easier to manage permissions. By creating IAM paths specific to each team (e.g., /product-team/, /security- team/, /platform-team/), you can apply a Service Control Policy (SCP) that…
Question
A company has hundreds of AWS accounts and uses AWS Organizations. The company plans to create many different IAM roles and policies for its product team, security team, and platform team. Some IAM policies will be shared across teams. A security engineer needs to implement a solution to logically group together the IAM roles of each team. The solution must allow only the platform team to delegate IAM permissions to AWS services. Which solution will meet these requirements?
Options
- ASet up an IAM path with the IAM roles for each team. Deploy an SCP that denies the
- BApply different tags for each team to the IAM roles. Deploy an SCP that denies the
- CApply different tags for each team to the IAM policies. Deploy an SCP that denies the
- DSet up an IAM path with the IAM roles for each team. Use IAM permissions boundaries to deny
How the community answered
(29 responses)- A76% (22)
- B3% (1)
- C14% (4)
- D7% (2)
Explanation
Using IAM paths allows you to organize and logically group IAM roles by team, making it easier to manage permissions. By creating IAM paths specific to each team (e.g., /product-team/, /security- team/, /platform-team/), you can apply a Service Control Policy (SCP) that restricts the permission to only roles within the platform team's path. This approach allows the platform team to delegate IAM permissions to AWS iam:PassRole services while preventing other teams from doing so, meeting both organizational and delegation
Topics
Community Discussion
No community discussion yet for this question.