SAP-C02 Q246 · Multi-Account

Question

A company needs to create and manage multiple AWS accounts for a number of departments from a central location. The security team requires read-only access to all accounts from its own AWS account. The company is using AWS Organizations and created an account for the security team. How should a solutions architect meet these requirements?

Accepted Answer

This answer correctly addresses all requirements:

1. **Read-only access requirement**: A new IAM role with read-only permissions is created in each member account. This follows the principle of least privilege — the security team only gets read-only access, not the full administrative access that OrganizationAccountAccessRole provides.

2. **Cross-account access mechanism**: The answer uses IAM roles with trust relationships, which is the standard AWS pattern for cross-account access. The trust relationship is established between the new IAM role in each member account and the security account, allowing security team members to assume the role.

3. **Central location (security account)**: The security team operates from their own AWS account and assumes roles into member accounts — a hub-

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

🔒 Security

🎯 Exam Tips