Which AWS Service Enables Single Sign-On Across Multiple AWS Accounts?

Why the Answer Is Correct

AWS IAM Identity Center (formerly AWS Single Sign-On) is the AWS service purpose-built for workforce identity: it holds or connects to a directory, and users sign in once and then assume permission sets (roles) in any number of AWS accounts. The requirement in this question — "authenticate and authorize multiple AWS accounts by using a single set of credentials" — maps exactly to that single sign-on portal, often reached via the AWS access portal or AWS CLI. Because permission sets are defined centrally and assigned per account, the user never needs separate credentials for each account. That is why option C is the answer the ACLF-C02 blueprint expects under access management capabilities.

Why the Other Options Are Wrong

Option A, AWS Organizations, is an account-management and consolidated-billing container: it creates and groups accounts and applies service control policies, but it has no user credential store or sign-in experience. Option B, an IAM user, is scoped to one account only — a single IAM user cannot natively authenticate into other accounts, which is precisely the problem the company is trying to solve. Option D, AWS Control Tower, automates landing-zone setup and governance across accounts, but it orchestrates accounts rather than authenticating end users. Note that IAM Identity Center is typically enabled within an organization from Organizations, which is why options A and D can feel adjacent to the requirement.

Community Comment Notes

Learners converged on C, and Aghajee's explanation correctly frames the service as providing "centralized authentication and authorization across multiple AWS accounts" plus one sign-in instead of per-account credentials. Another commenter highlights that "users can use their directory credentials for single sign-on access to multiple AWS accounts" and that the access portal shows assigned roles in one place, which matches the portal behavior you should picture on the exam. bindu991 simply wrote "AWS SSO", the older name of the same service — useful because the exam may still use either name. There is no community dissent here, and the unanimous reasoning aligns with the official AWS documentation.