AWS IAM Identity Center Permission Sets for Least Overhead

SAA-C03 By islever Editorial Last updated Oct 13, 2026

Short answer

C Create new permission sets that include the appropriate IAM policies for each group. Assign the new groups to the appropriate accounts. Assign the new permission sets to the new groups.

Question

A company manages AWS accounts in AWS Organizations. AWS IAM Identity Center (AWS Single Sign-On) and AWS Control Tower are configured for the accounts. The company wants to manage multiple user permissions across all the accounts. The permissions will be used by multiple IAM users and must be split between the developer and administrator teams. Each team requires different permissions. The company wants a solution that includes new users that are hired on both teams. Which solution will meet these requirements with the LEAST operational overhead?

Create individual users in IAM Identity Center for each account. Create separate developer and administrator groups in IAM Identity Center. Assign the users to the appropriate groups. Create a custom IAM policy for each group to set fine-grained permissions.
Create individual users in IAM Identity Center for each account. Create separate developer and administrator groups in IAM Identity Center. Assign the users to the appropriate groups. Attach AWS managed IAM policies to each user as needed for fine-grained permissions.
Create individual users in IAM Identity Center. Create new developer and administrator groups in IAM Identity Center. Create new permission sets that include the appropriate IAM policies for each group. Assign the new groups to the appropriate accounts. Assign the new permission sets to the new groups. When new users are hired, add them to the appropriate group. Correct Answer
Create individual users in IAM Identity Center. Create new permission sets that include the appropriate IAM policies for each user. Assign the users to the appropriate accounts. Grant additional IAM permissions to the users from within specific accounts. When new users are hired, add them to IAM Identity Center and assign them to the accounts.

Key Takeaways

The exam tests knowledge of Identity Center's scalable permission management; the common trap is choosing per-user assignments or standard IAM groups which fail to scale in an organization.

This question addresses the most efficient method to manage granular permissions across multiple AWS accounts using AWS IAM Identity Center. The correct approach leverages Permission Sets and Groups to minimize operational overhead.

Common mistake: Option D is a frequent distractor because it sounds like direct assignment, but assigning policies to individual users rather than groups creates massive administrative burden when scaling.

Expert Analysis

Why the Answer Is Correct

Correct answer: C — Create new permission sets that include the appropriate IAM policies for each group. Assign the new groups to the appropriate accounts. Assign the new permission sets to the new groups.

AWS IAM Identity Center (formerly SSO) is designed to centralize access management across AWS Organizations. The core mechanism for this is 'Permission Sets,' which act as managed IAM roles that can be assigned to users or groups within specific accounts. By creating groups (Developer/Administrator) and attaching Permission Sets to these groups, you decouple user identity from specific permissions. This allows you to assign the same set of permissions to multiple users simultaneously without managing individual policies. When new users are hired, they are simply added to the relevant group, inheriting the existing Permission Set assignments automatically. This is the definition of least operational overhead.

Why the Other Options Are Wrong

Option A suggests creating custom IAM policies for each group. While possible, Identity Center manages permissions via Permission Sets (which wrap IAM roles). Creating custom inline policies is more complex and less integrated with the IdC workflow than using standard Permission Sets. Option B suggests attaching AWS managed IAM policies to each user individually. This violates best practices for scalability and increases overhead significantly as every new hire requires manual policy attachment. Option D suggests assigning permission sets to individual users. While technically supported, this scales poorly; if you have 100 developers, you must manage 100 distinct assignments rather than one group assignment.

Community Comment Notes

The community consensus strongly supports option C, noting it provides the 'least overhead' as requested. As LeonSauveterre noted, using Identity Center to centrally manage user access via Permission Sets for Developer and Administrator teams is the standard architectural pattern. Another commenter confirmed that C is the correct choice based on official documentation links shared in the thread.

Official Reference

https://docs.aws.amazon.com/singlesignon/latest/userguide/permissionsets.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

When asked about 'least operational overhead' in multi-account environments, always look for solutions that leverage grouping and centralized management tools like IAM Identity Center Permission Sets rather than individual user configurations.

Frequently Asked Questions

Why not assign Permission Sets directly to users instead of groups?

Assigning to users does not scale well. Adding a new developer requires assigning the permission set individually to every new user, whereas adding them to a group applies it automatically.

What is the difference between a Group and a Permission Set?

A Group is a collection of users. A Permission Set is a set of IAM permissions (like an IAM role). You attach Permission Sets to Groups to grant those permissions to all members of the group.

More SAA-C03 FAQ →

Community Votes

100%

100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 6 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 6

Andy_09 👍 3

The correct answer should be C
Moon239 👍 2 Answered C

https://docs.aws.amazon.com/controltower/latest/userguide/sso.html
LeonSauveterre 👍 1 Answered C

I would: 1. Use AWS IAM Identity Center (SSO) to centrally manage user access across all accounts. 2. Create Permission Sets in Identity Center: - One for the Developer Team, granting access to resources with developer-specific permissions (AmazonEC2FullAccess or custom policies or something). - Another one for the Administrator Team, granting administrator-specific permissions (AdministratorAccess or something). 3. Sync users and groups from the corporate identity provider (or manage groups directly in IAM Identity Center) to automatically apply these permissions. 4. Assign these Permission Sets to groups of users in Identity Center rather than individuals, ensuring new users automatically inherit the appropriate permissions based on their group. That's why you choose C, with the least operational overhead.
1Alpha1 👍 1 Answered C

Check out this one. https://www.youtube.com/watch?v=y_n9xN5mg1g
Cali182 👍 2 Answered C

Correct is C

Show 1 more comment

xBUGx 👍 1 Answered C

C is least overhead

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide