SAA-C03 Q343 · IAM

Question

A company runs all its business applications in the AWS Cloud. The company uses AWS Organizations to manage multiple AWS accounts. A solutions architect needs to review all permissions that are granted to IAM users to determine which IAM users have more permissions than required. Which solution will meet these requirements with the LEAST administrative overhead?

Accepted Answer

**IAM Access Analyzer** is purpose-built for exactly this use case. Here's how it satisfies each requirement:

1. **Review all permissions granted to IAM users**: IAM Access Analyzer provides **policy validation** and **unused access analysis**. It can identify permissions that have been granted but are not actually being used — directly answering the question of which users have 'more permissions than required.'

2. **Works across multiple AWS accounts**: When configured with **AWS Organizations as the zone of trust**, IAM Access Analyzer can analyze resources and access across all accounts in the organization from a single place.

3. **Least administrative overhead**: IAM Access Analyzer is a managed service. You enable it, set the zone of trust to your organization, and it continuously

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

💰 Cost

🔒 Security

🎯 Exam Tips