Exam AWS Certified Solutions Architect - Professional SAP-C02 topic 1 question 391 discussion

Option B correct: Key word - "OrganizationAccountAccessRole", By assuming the OrganizationAccountAccessRole, you gain temporary, controlled access to the member account without sharing root credentials or creating separate IAM users for cross-account access. This enhances security and reduces administrative overhead.

B is right Using IAM user credentials: The solution architect should use the Support1 IAM user credentials from the management account to create IAM users in the new member account, not the root account credentials. Assuming roles: By switching roles using the OrganizationAccountAccessRole role with the account ID of the new member account, the solution architect can access the resources and perform actions on behalf of the new member account without using the management account's root credentials.

Option B

b ISANS https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_access.html

D is my answer. Those who chose B are correct about the process and the role that is created when you setup the account. But the user (Support1) that has management account access to setup a new account in the organisation automatically becomes part of the administrators in the new account that gets created and therefore will be able to access the new account with his/her credentials by specifying the new account. The root user with the 64 character password is also a valid approach but it is not a recommended one by AWS.

B as most secure way

https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_access.html

Answer: B

quote out of article posted by thala: "When you create a member account, AWS Organizations automatically creates an AWS Identity and Management (IAM) role called OrganizationAccountAccessRole in the account. This role has full administrative permissions in the member account." B is only valid answer, assume the role and perform administrative actions

https://repost.aws/knowledge-center/organizations-member-account-access

D is the correct answer

Answer: D