IAM Identity Center vs IAM Roles for Least Privilege

SAA-C03 By islever Editorial Last updated

Design secure access to AWS resources.

Short answer

B Enable IAM Identity Center with Permission Sets to centrally manage granular access for teams while minimizing operational overhead.

Question

A company is building a cloud-based application on AWS that will handle sensitive customer data. The application uses Amazon RDS for the database, Amazon S3 for object storage, and S3 Event Notifications that invoke AWS Lambda for serverless processing. The company uses AWS IAM Identity Center to manage user credentials. The development, testing, and operations teams need secure access to Amazon RDS and Amazon S3 while ensuring the confidentiality of sensitive customer data. The solution must comply with the principle of least privilege. Which solution meets these requirements with the LEAST operational overhead?
  1. Use IAM roles with least privilege to grant all the teams access. Assign IAM roles to each team with customized IAM policies defining specific permission for Amazon RDS and S3 object access based on team responsibilities.
  2. Enable IAM Identity Center with an Identity Center directory. Create and configure permission sets with granular access to Amazon RDS and Amazon S3. Assign all the teams to groups that have specific access with the permission sets. Correct Answer
  3. Create individual IAM users for each member in all the teams with role-based permissions. Assign the IAM roles with predefined policies for RDS and S3 access to each user based on user needs. Implement IAM Access Analyzer for periodic credential evaluation.
  4. Use AWS Organizations to create separate accounts for each team. Implement cross-account IAM roles with least privilege. Grant specific permission for RDS and S3 access based on team roles and responsibilities.

Key Takeaways

The exam tests the distinction between manual IAM policy management and centralized identity governance, with the common trap being the selection of granular IAM roles (Option A) which ignores the 'least operational overhead' constraint.

This question evaluates the optimal method for managing secure access to AWS resources while minimizing operational overhead. It establishes that IAM Identity Center is the superior solution for centralized identity management compared to traditional IAM roles or users.

Common mistake: Candidates often choose Option A because it adheres strictly to least privilege, but they fail to recognize that managing individual policies for multiple teams creates significant operational overhead compared to Identity Center's permission sets.

Expert Analysis

Why the Answer Is Correct

Option B is correct because IAM Identity Center (formerly AWS SSO) is designed specifically to simplify user management and access control across AWS organizations. By using Permission Sets, administrators can assign granular permissions to groups, which automatically applies these policies to all members. This approach centralizes credential management and reduces the administrative burden significantly, directly addressing the requirement for 'least operational overhead'.

Why the Other Options Are Wrong

Option A requires creating and maintaining custom IAM policies for each team, which scales poorly and increases maintenance complexity as teams evolve. Option C involves managing individual IAM users, which is widely considered a legacy practice due to the high overhead of handling long-term credentials and per-user policies. Option D suggests using separate AWS accounts, which adds substantial operational overhead regarding account management, billing, and cross-account role trust relationships, making it inefficient for this scenario.

Community Comment Notes

Community feedback strongly supports Option B, with users noting that IAM Identity Center streamlines access management. As one commenter noted, "Managing and customizing IAM roles for multiple teams can become more and more complex," whereas Identity Center allows updates from one place. Another user highlighted that Option C is "TOO MUCH WORK" and Option D introduces "additional operational overhead." The consensus is clear: centralization wins on operational efficiency.

Official Reference

https://docs.aws.amazon.com/singlesignon/latest/userguide/what-is.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

When an AWS exam question emphasizes 'operational overhead' or 'management complexity,' look for managed services like IAM Identity Center or AWS Organizations rather than manual IAM constructs. Always prioritize solutions that centralize control over those requiring per-resource or per-user configuration.

Frequently Asked Questions

Why not use IAM Roles for EC2 instead of Identity Center?

IAM Roles are ideal for AWS services, but for human users accessing the console/API, Identity Center provides centralized group-based management which has lower overhead than individual role assignments.

Is separating teams into different AWS Accounts (Option D) better?

While isolation is good, creating separate accounts for each team introduces high operational overhead in account management, billing, and cross-account role configuration, violating the 'least overhead' constraint.

More SAA-C03 FAQ →

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

  1. kevindu 👍 9 Answered B
    Is there anyone who has recently passed the exam who can tell me approximately how many of the original questions are in the actual exam?
  2. dhewa 👍 5 Answered B
    IAM Identity Center: This service simplifies user management by centralizing credentials and access control. Permission Sets: You can create granular permission sets that align with the principle of least privilege, ensuring that each team has only the access they need. Group Assignments: By assigning teams to groups with specific permission sets, you streamline access management and reduce the complexity of individual user permissions. This approach minimizes operational overhead while maintaining secure and compliant access to sensitive customer data
  3. JoeTromundo 👍 2 Answered B
    Option A is goo but not the best, which is option B.
  4. LeonSauveterre 👍 1 Answered B
    A - Managing and customizing IAM roles for multiple teams can become more and more complex and high-maintenance, especially if team responsibilities evolve. B - IAM Identity Center (formerly AWS SSO) allows you to manage/update access for multiple teams from one place. C - TOO MUCH WORK. D - Cross-account access is harder to manage and introduces additional operational overhead.
  5. aragon_saa 👍 3 Answered B
    Answer is B

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide