Exam AWS Certified Security - Specialty topic 1 question 52 discussion

D is the correct answer

Answer is D. Beware the trick in C : It will not be "FinanceDept" it will be "MasterPayer" account.

Assume role for cross account in this case

The permissions for the IAM role must be provisioned in the MasterPayer account with viewbilling permission. Then grant the FinanceDept the ability to assume the role. D

D is my option.

D. Create an AWS IAM role in the MasterPayer account with the ViewBilling permission, then grant the finance users in the FinanceDept account the permission to assume that role.

D is correct answer because of two reasons: One its secure , when any user or service assume role - STS provide temp credentials in the backend and it expires after sometime C is not correct because you have to create the role in target and user/service has to assume to access the target A is wrong obviously because user need access in master account B is wrong because every time user has to login to master account, it easy for user to keep logged in single account and access other account by assuming a role and it does not provide long term credentials to users

Ans: D 100%

D is the right answer

D is Correct

Looks like D to me.

Ans > D

Ans(D)

D is correct. Standard configuration of Cross-account access control

D should be the correct answer. The question clearly mentions that the IAM users are part of the finance account. When you switch role, the destination account is where you need to create the role that can be assumed when switching into the respective account. Moreover it's consolidated billing, and there are around 50 accounts so it's easy to switch to the master account to see the entire billing data.

D, for sure

D is correct