Operations staff need AWS console access across multiple accounts.
Long-lived access keys must not be distributed, MFA must be required, and permissions must match each person's duties.
Which design is most appropriate?
Use IAM Identity Center to assign permission sets to users or groups, require MFA, and provide temporary console credentials across accounts.
Detailed explanation
Root long-term keys carry exceptional risk and should not be used for routine operations.
Root long-term keys carry exceptional risk and should not be used for routine operations.
Identity Center provides federated access across accounts with permission sets, temporary credentials, and MFA controls.
Identity Center provides federated access across accounts with permission sets, temporary credentials, and MFA controls.
Shared principals and long-lived keys reduce traceability and increase exposure; they do not provide MFA-protected temporary access.
Shared principals and long-lived keys reduce traceability and increase exposure; they do not provide MFA-protected temporary access.
An S3 object does not provide authentication, MFA, or account-wide permission assignment.
An S3 object does not provide authentication, MFA, or account-wide permission assignment.
Check official documentation
Compare the following points with the official documentation.
AWS IAM Identity Center permission sets and MFAの公式説明を確認する。
Official references
What to confirm
IAMユーザーの長期キー、root資格情報、Identity Centerの一時的な権限配布を比較できる。
Key points
- IAM Identity Center
- Permission set
- MFA
- Temporary credentials
Notes
- Environment: AWS公式SOA-C03試験ガイドとAWS公式ドキュメントの確認
- Confirm current behavior in the official SOA-C03 guide and AWS service documentation.
Foundation review
Workforce identity
Human console access is managed separately from workload roles and should be traceable to an individual.
Least privilege
Each operator receives only the account actions and resources required for the assigned duty.