Least Overhead IAM Permission Review in AWS Organizations

SAA-C03 By islever Editorial Last updated

Design secure access to AWS resources.

Short answer

C Use AWS Identity and Access Management (IAM) Access Analyzer to review all the company’s resources and accounts.

Question

A company runs all its business applications in the AWS Cloud. The company uses AWS Organizations to manage multiple AWS accounts. A solutions architect needs to review all permissions that are granted to IAM users to determine which IAM users have more permissions than required. Which solution will meet these requirements with the LEAST administrative overhead?
  1. Use Network Access Analyzer to review all access permissions in the company's AWS accounts.
  2. Create an AWS CloudWatch alarm that activates when an IAM user creates or modifies resources in an AWS account.
  3. Use AWS Identity and Access Management (IAM) Access Analyzer to review all the company’s resources and accounts. Correct Answer
  4. Use Amazon Inspector to find vulnerabilities in existing IAM policies.

Key Takeaways

The question tests the correct service for auditing IAM permissions (IAM Access Analyzer) versus general security or logging tools, highlighting the trap of confusing 'Access Analyzer' with 'Network Access Analyzer'.

Use AWS IAM Access Analyzer to identify excessive permissions for IAM users across multiple accounts with minimal administrative overhead. This tool automatically analyzes resource policies and access logs to detect unintended public or cross-account access.

Common mistake: Learners often select Amazon Inspector, mistakenly believing it audits IAM policies for vulnerabilities rather than EC2 instance vulnerabilities. Others may choose CloudWatch alarms, which are reactive monitoring tools, not audit/reporting solutions.

Expert Analysis

Why the Answer Is Correct

AWS IAM Access Analyzer is specifically designed to help you analyze the resource policies in your organization to determine if any resources are shared with an external principal. It continuously monitors access activity and generates findings when it detects potential issues, such as overly permissive policies. By enabling it for your AWS Organization, a solutions architect can centrally review all permissions granted to IAM users across all member accounts without writing custom scripts or managing individual IAM credentials, thus meeting the "least administrative overhead" requirement.

Why the Other Options Are Wrong

Option A is incorrect because there is no AWS service called "Network Access Analyzer"; this appears to be a distractor combining VPC Flow Logs or Security Groups with IAM concepts. Option B (CloudWatch Alarms) is a monitoring tool that triggers notifications based on metric thresholds but does not provide a comprehensive audit report of existing permissions or policy evaluations. Option D (Amazon Inspector) is an automated vulnerability management service for EC2 instances and container images, not for auditing IAM user permissions or policy grants.

Community Comment Notes

The community consensus strongly supports option C, with users noting that IAM Access Analyzer is the standard tool for this specific use case. As one commenter succinctly stated, "Answer is C," reinforcing that this is a straightforward knowledge-based question regarding AWS identity services. Another user confirmed, "C is correct," indicating high agreement among learners.

Official Reference

https://aws.amazon.com/iam/access-analyzer/

This link opens the official vendor documentation in a new tab.

Exam Strategy

When asked about reviewing permissions or identifying unused/excessive privileges in AWS Organizations, prioritize IAM Access Analyzer or AWS Audit Manager over manual checks or generic logging services like CloudWatch. Remember that Access Analyzer focuses on policy analysis and finding unintended access.

Frequently Asked Questions

Why isn't Amazon Inspector used for IAM policy reviews?

Amazon Inspector scans EC2 instances and container images for software vulnerabilities, not IAM policies or user permissions.

Does IAM Access Analyzer work across multiple AWS accounts?

Yes, when enabled in AWS Organizations, it can analyze resources and permissions across all member accounts centrally.

More SAA-C03 FAQ →

Community Votes

C
100%

100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. muhammadahmer36 👍 2 Answered C
    https://aws.amazon.com/iam/access-analyzer/
  2. komorebi 👍 3 Answered C
    Answer is C
  3. swati1508 👍 2
    C is correct

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide