Question

A company uses AWS IAM Identity Center (federated to an external corporate IdP) to manage access across 60 accounts in AWS Organizations. Security requires a documented "break-glass" procedure that grants a small group of on-call engineers full administrative access to any account during a Sev-1 incident, even if the corporate IdP is unavailable. Normal daily access must continue to flow through the IdP. The solution must minimize the standing privileged footprint and provide a clear audit trail of when break-glass access is used. Which approach BEST meets these requirements?

Accepted Answer

Create a small number of break-glass IAM roles with AdministratorAccess in each account, trusted only by a locked-down IAM group of native IAM users (not the external IdP) whose credentials are stored in a monitored vault, and use CloudTrail plus EventBridge alarms to alert whenever those roles are assumed.

Answer

Create dedicated IAM users with AdministratorAccess in the management account and share the long-term access keys with the on-call team in a password vault.

Answer

Add an additional Identity Center permission set with AdministratorAccess assigned to the on-call group and rely on the external IdP for authentication during incidents.

Answer

Attach an SCP that grants the on-call engineers administrative privileges only during declared incidents, activating it manually when an incident begins.