Exam AWS Certified Solutions Architect - Professional topic 1 question 910 discussion

Answer seems to be B Snippet: "You can also add the users that you create in AWS SSO to groups you create in AWS SSO. In addition, you can create permissions sets that define permitted actions on an AWS resource, and assign them to your users and groups. For example, you can grant the DevOps group permissions to your production AWS accounts. When you add users to the DevOps group, they get access to your production AWS accounts automatically." REf - https://aws.amazon.com/blogs/security/how-to-create-and-manage-users-within-aws-sso/ PS - New service is - AWS IAM Identity Center (Successor to AWS Single Sign-On)

The most appropriate solution for the given requirement is option B. The solutions architect should create a group in AWS SSO for each job function and in the management account create a permission set for each job function. Then adding users to the appropriate groups and assigning groups to AWS accounts with corresponding permission sets. This approach allows the solutions architect to create granular permissions for different job functions by creating separate groups for each job function, and assigning the corresponding permission sets to each group. This way all the users in that group will have the permissions based on the job function. AWS SSO is a central service to manage access to multiple AWS accounts, and it allows you to create groups and assign different permission sets to them, in addition it allows you to connect these groups with AWS Accounts.

B - This is how we setup new AWS client environments.

B is correct

it's should be B

B, and use that single permission set to grant access to a list of target AWS accounts within your AWS Organization IAM Identity Center assigns access to a user or group in one or more AWS accounts with permission sets. When you assign a permission set, IAM Identity Center creates corresponding IAM Identity Center-controlled IAM roles in each account, and attaches the policies specified in the permission set to those roles.

D - create role and policy permission in management account for granular control