IAM AdministratorAccess Identity-Based Policy for Full Access

SAA-C03 By islever Editorial Last updated

Design secure access to AWS resources.

Short answer

C Attach the AdministratorAccess identity-based policy to the IAM user group and place each employee user in that group.

Question

A solutions architect is designing an AWS Identity and Access Management (IAM) authorization model for a company's AWS account. The company has designated five specific employees to have full access to AWS services and resources in the AWS account. The solutions architect has created an IAM user for each of the five designated employees and has created an IAM user group. Which solution will meet these requirements?
  1. Attach the AdministratorAccess resource-based policy to the IAM user group. Place each of the five designated employee IAM users in the IAM user group.
  2. Attach the SystemAdministrator identity-based policy to the IAM user group. Place each of the five designated employee IAM users in the IAM user group.
  3. Attach the AdministratorAccess identity-based policy to the IAM user group. Place each of the five designated employee IAM users in the IAM user group. Correct Answer
  4. Attach the SystemAdministrator resource-based policy to the IAM user group. Place each of the five designated employee IAM users in the IAM user group.

Key Takeaways

The core trap is confusing resource-based policies with identity-based policies and misunderstanding the scope of the SystemAdministrator versus AdministratorAccess managed policies.

This question tests the correct application of AWS IAM managed policies for granting full administrative access. The solution requires attaching an identity-based policy, not a resource-based one.

Common mistake: Candidates often select options involving 'resource-based' policies because they misread the requirement or confuse how permissions are attached to groups versus resources.

Expert Analysis

Why the Answer Is Correct

Option C is the only correct choice because it correctly identifies that permissions for IAM users must be applied via identity-based policies when attaching them to a group. The AdministratorAccess policy is the standard AWS managed policy that grants full access to all AWS services and resources in the account, matching the requirement exactly.

Why the Other Options Are Wrong

Options A and D are incorrect because they propose using resource-based policies. Resource-based policies (like bucket policies) are attached directly to AWS resources, not to IAM identities like users or groups. Option B is incorrect because the SystemAdministrator managed policy only grants access to a limited subset of services (approximately 28 out of 400+), failing the 'full access' requirement.

Community Comment Notes

Community consensus strongly supports C. Users noted that resource-based policies cannot be attached to user groups, eliminating A and D immediately. As Linuslin commented, "SystemAdministrator: Allow 28 of 412 services... AdministratorAccess: Allow 412 of 412 services," confirming the scope difference between the two identity-based options.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Always distinguish between identity-based and resource-based policies. If the action involves attaching a policy to a User, Group, or Role, it must be an identity-based policy. If the question asks for 'full access', look for AdministratorAccess; do not assume SystemAdministrator provides equivalent privileges.

Frequently Asked Questions

Why can't I attach a resource-based policy to an IAM group?

Resource-based policies are attached to AWS resources (like S3 buckets or DynamoDB tables) to define who can access them. They cannot be attached to IAM identities like users, groups, or roles.

What is the difference between AdministratorAccess and SystemAdministrator?

AdministratorAccess is a managed policy that grants full access to all AWS services and resources. SystemAdministrator is a managed policy that grants access to only a limited subset of services (around 28).

More SAA-C03 FAQ →

Community Votes

C
100%

100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 7 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 7

  1. Scheldon 👍 6 Answered C
    AnswerC We need identity-based policy and if we will compare System Admin and Administrator Access policy it clear that SysAdmin have is allowing for limited amount of actions, where Admin Access simple allow for all actions. https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_identity-vs-resource.html https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AdministratorAccess.html https://docs.aws.amazon.com/aws-managed-policy/latest/reference/SystemAdministrator.html
  2. Linuslin 👍 6 Answered C
    The question says "full access to AWS services and resources in the AWS account" and "created an IAM user group." You can see it is identity-based policy, not resource-based.--->A and D are out. SystemAdministrator: Allow 28 of 412 services.--->B is out. AdministratorAccess: Allow 412 of 412 services.--->C is the correct answer. If you are curious about what a policy can allow for, just log in you AWS account and go to IAM-policies to find out.
  3. NSA_Poker 👍 5 Answered C
    (A & D) eliminated. Resource-based policies are attached to a resource NOT an IAM user, group, or role. (B) eliminated. SystemAdministrator has fewer permissions than AdministratorAccess.
  4. osmk 👍 3 Answered C
    C>>>https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-attach-detach.html
  5. Andy_09 👍 4
    Option C
Show 2 more comments
  1. Umuntu 👍 3
    C looks correct
  2. MattBJ 👍 2 Answered C
    C is the correct answer

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide