Users in one organization need access to several AWS accounts.
Account-specific permissions should be assigned centrally to users and groups.
Which capability is primarily appropriate?
IAM Identity Center assigns permission sets to users and groups for centrally managed access to multiple AWS accounts.
Detailed explanation
IAM Identity Center provides centralized workforce access and account-specific permission assignments.
IAM Identity Center provides centralized workforce access and account-specific permission assignments.
This ignores job responsibilities and violates least-privilege goals.
This ignores job responsibilities and violates least-privilege goals.
Root-password sharing is not a controlled or auditable workforce-access method.
Root-password sharing is not a controlled or auditable workforce-access method.
An S3 resource policy controls S3 access, not organization-wide workforce identity and account access.
An S3 resource policy controls S3 access, not organization-wide workforce identity and account access.
Check official documentation
Compare the following points with the official documentation.
IAM Identity Center User GuideのConfigure access to AWS accountsとpermission setsを確認する。
What to confirm
ユーザーまたはグループにpermission setを割り当て、対象アカウントへ必要なロールアクセスを提供する。
Key points
- IAM Identity Center
- Permission set
- User and group
Notes
- Environment: AWS公式IAM Identity Centerドキュメントの確認
- Confirm current IAM capabilities and recommended practices in the official AWS documentation.
Foundation review
Central management
Identity Center reduces repeated account-by-account user management.
Scoped assignment
Permission sets can provide different access in different AWS accounts.