Exam AWS Certified Solutions Architect - Professional SAP-C02 topic 1 question 233 discussion

D - Cross account role should be created in destination(member) account. The role has trust entity to master account.

A is ans A. Create an IAM user and a cross-account role in the management account. Configure the cross-account role with least privilege access to the member accounts. Here's why: Cross-account roles: Provide a secure and managed way for users or services in one AWS account to access resources in another account. Least privilege access: Configure the cross-account role with the minimum permissions needed to stop or terminate resources in the member accounts, minimizing potential security risks. Centralized control: Maintaining user credentials and access in the management account simplifies centralized management and auditing.

Option D

Hmm, seems like alot of work. What if the question was, In the management account, a solutions architect needs to create an IAM user that can stop or terminate resources in 100 organization or member accounts? Asked AI "Using AWS Organizations, can you create both IAM user and permission sets in the management account for accessing managed organization resources?" The answer was Yes.

its a D

One user is sufficient and you need cross-account role.

D - Cross account role should be created in destination(member) account. The role has trust entity to master account.

D - Cross account role should be created in destination account(which is member account) and trust policy should be there