Question

A SysOps administrator manages a multi-account AWS Organization. The security team requires that developers in a member account can create IAM roles for their applications, but those created roles must never be able to modify billing, leave the organization, or access CloudTrail settings. Additionally, the developers themselves must never be able to grant more permissions than a defined maximum, even when creating new roles. Which combination of controls correctly enforces these requirements?

Accepted Answer

Attach a Service Control Policy (SCP) to the member account's OU to deny the sensitive actions, and require developers to attach a permission boundary to every IAM role they create.

Answer

Attach an identity-based policy to each developer denying the sensitive actions, and rely on IAM Access Analyzer to block role creation that exceeds the maximum.

Answer

Create an SCP that allows only the specific developer actions and attach it directly to each developer IAM user in the member account.

Answer

Use a resource-based policy on the CloudTrail and billing services to deny developer access, and enable MFA for all role creation operations.