AWS Certified Solutions Architect – Professional (SAP-C02) — Question 277

A company needs to create and manage multiple AWS accounts for a number of departments from a central location. The security team requires read-only access to all accounts from its own AWS account. The company is using AWS Organizations and created an account for the security team.

How should a solutions architect meet these requirements?

Answer options

• A. Use the OrganizationAccountAccessRole IAM role to create a new IAM policy with read-only access in each member account. Establish a trust relationship between the IAM policy in each member account and the security account. Ask the security team to use the IAM policy to gain access.
• B. Use the OrganizationAccountAccessRole IAM role to create a new IAM role with read-only access in each member account. Establish a trust relationship between the IAM role in each member account and the security account. Ask the security team to use the IAM role to gain access.
• C. Ask the security team to use AWS Security Token Service (AWS STS) to call the AssumeRole API for the OrganizationAccountAccessRole IAM role in the management account from the security account. Use the generated temporary credentials to gain access.
• D. Ask the security team to use AWS Security Token Service (AWS STS) to call the AssumeRole API for the OrganizationAccountAccessRole IAM role in the member account from the security account. Use the generated temporary credentials to gain access.

Correct answer: B

Explanation

Option B is correct because the default OrganizationAccountAccessRole has administrative permissions, so it should be used to set up a new, restricted cross-account IAM role in each member account that trusts the security account. Option A is incorrect because trust relationships cannot be established with an IAM policy, only with an IAM role. Options C and D are incorrect because directly assuming the OrganizationAccountAccessRole would grant the security team full administrative access instead of the required read-only access.