Question

A SysOps administrator manages 40 IAM users who all require identical S3 and CloudWatch read permissions. The company frequently onboards and offboards staff, and the security team complains that permissions drift because policies are attached inconsistently to individual users. Which approach best ensures consistent, maintainable permission management?

Accepted Answer

Create an IAM group with a managed policy granting the required permissions and add all users to that group.

Answer

Attach an inline policy with the required permissions to each IAM user individually and document the JSON in a runbook.

Answer

Create an IAM role with the required permissions and have each user assume the role via the AWS Management Console daily.

Answer

Apply a Service Control Policy (SCP) at the organization root granting the S3 and CloudWatch read permissions to all users.