SCS-C03 · Question #28
A company that uses AWS Organizations is using AWS IAM Identity Center to administer access to AWS accounts. A security engineer is creating a custom permission set in IAM Identity Center. The…
The correct answer is A. Create the customer managed policy in every account where the permission set is assigned. Give. AWS IAM Identity Center permission sets that include customer managed policies require those policies to exist in each target account. According to the AWS Certified Security - Specialty Study Guide, customer managed policies are account-scoped and are not automatically…
Question
A company that uses AWS Organizations is using AWS IAM Identity Center to administer access to AWS accounts. A security engineer is creating a custom permission set in IAM Identity Center. The company will use the permission set across multiple accounts. An AWS managed policy and a customer managed policy are attached to the permission set. The security engineer has full administrative permissions and is operating in the management account. When the security engineer attempts to assign the permission set to an IAM Identity Center user who has access to multiple accounts, the assignment fails. What should the security engineer do to resolve this failure?
Options
- ACreate the customer managed policy in every account where the permission set is assigned. Give
- BRemove either the AWS managed policy or the customer managed policy from the permission
- CEvaluate the logic of the AWS managed policy and the customer managed policy. Resolve any
- DDo not add the new permission set to the user. Instead, edit the user's existing permission set to
How the community answered
(44 responses)- A82% (36)
- B5% (2)
- C9% (4)
- D5% (2)
Explanation
AWS IAM Identity Center permission sets that include customer managed policies require those policies to exist in each target account. According to the AWS Certified Security - Specialty Study Guide, customer managed policies are account-scoped and are not automatically propagated across accounts by Identity Center. When assigning a permission set across multiple accounts, Identity Center attempts to attach the fails. Creating the same customer managed policy with identical name and permissions in every target account resolves the issue. Option B increases complexity. Option C does not address the root cause. Option D violates Identity Center management best practices. AWS documentation clearly states that customer managed policies must be present in all accounts where permission sets are applied.
Topics
Community Discussion
No community discussion yet for this question.