AWS Certified Security – Specialty — Question 241

A large company has hundreds of AWS accounts. The company needs to provide its employees with access to these accounts. The solution must maximize scalability and operational efficiency.
Which solution meets these requirements?

Answer options

• A. With each AWS account, create dedicated IAM users that employees can assume through federation based upon group membership in their existing identity provider.
• B. Use a centralized account with IAM roles that employees can assume through federation with their existing identity provider. Create a custom authorizer by using AWS SDK to give federated users the ability to assume their target role in the resource accounts.
• C. Implement AWS Control Tower for multi-account management by integrating AWS Single Sign-On with the company's existing identity provider. Create IAM roles for the identity provider to assume.
• D. Configure the IAM trust policies within each account's role to set up a trust back to the company's existing identity provider. Allow users to assume the role based on their SAML token.

Correct answer: C

Explanation

Option C is correct because it leverages AWS Control Tower and AWS Single Sign-On, which streamline multi-account management and integrate with existing identity providers efficiently. Options A and D involve more manual configurations and do not scale as effectively, while option B, though centralized, lacks the seamless integration provided by AWS Control Tower and Single Sign-On.