SAP-C02 Q391 · Multi-Account

Question

A financial company needs to create a separate AWS account for a new digital wallet application. The company uses AWS Organizations to manage its accounts. A solutions architect uses the IAM user Supportl from the management account to create a new member account with finance1@example.com as the email address. What should the solutions architect do to create IAM users in the new member account?

Accepted Answer

When you create a new member account using AWS Organizations, AWS automatically creates an IAM role called **OrganizationAccountAccessRole** in the new member account. This role:

1. **Trusts the management account** — The trust policy allows principals from the management account to assume this role.
2. **Has AdministratorAccess** — The role has full administrative permissions in the new member account.
3. **Is immediately available** — No additional setup is needed; the role exists from the moment the account is created.

The solutions architect can **switch roles** from the management account (using their Support1 IAM user) to assume the OrganizationAccountAccessRole in the new member account by specifying the new account's ID. Once assumed, they have full admin access to create IAM use

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

🔒 Security

🎯 Exam Tips