SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company has 200 AWS accounts in AWS Organizations. The security team wants to centrally manage IAM roles that grant cross-account access to a central security tooling account. The roles must be created consistently in every account, and any change to the role trust policy must propagate automatically. Which approach requires the LEAST ongoing effort?
⚠ Common exam trap
The trap here is assuming AWS Resource Access Manager can share IAM roles or that IAM Identity Center permission sets are the right tool for a service-to-service cross-account role, when StackSets is the managed deployment mechanism.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use AWS CloudFormation StackSets with service-managed permissions to deploy a stack set containing the IAM role to all accounts in the organization, and update the stack set when the trust policy changes.
CloudFormation StackSets with service-managed permissions is designed for organization-wide deployment of resources such as IAM roles. It automatically targets all accounts, including new ones, and a stack set update rolls the new trust policy to every account. This yields consistent role definitions and minimal ongoing operational effort compared with scripts or unsupported sharing mechanisms.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create an IAM role in each account using a script that assumes a role in each account and calls CreateRole, and schedule the script to run weekly.
Why it's wrong here
A custom script requires maintaining credentials, handling errors, and running on a schedule, which introduces drift between runs and operational overhead. It does not automatically cover newly created accounts and is more error-prone than a managed deployment mechanism. This approach does not meet the least-effort requirement.
- ✗
Use AWS Resource Access Manager to share an IAM role from the security tooling account to all other accounts.
Why it's wrong here
AWS Resource Access Manager shares supported resource types such as subnets, transit gateways, and license configurations. IAM roles are not shareable resources, so this approach is not possible. Cross-account role access is instead granted through trust policies and identity-based policies, not resource sharing.
- ✗
Create a single IAM role in the management account and use AWS Single Sign-On permission sets to map users to that role in all accounts.
Why it's wrong here
AWS IAM Identity Center permission sets create roles in target accounts, but they are designed for workforce user access, not for a service role assumed by a central tooling account. Managing trust policy changes across permission sets is not equivalent to updating a single stack set, and it does not provide the required programmatic cross-account role pattern.
- ✓
Use AWS CloudFormation StackSets with service-managed permissions to deploy a stack set containing the IAM role to all accounts in the organization, and update the stack set when the trust policy changes.
Why this is correct
CloudFormation StackSets with service-managed permissions automatically deploy and update stacks across all accounts in an organization, including new accounts as they are added. Updating the stack set propagates the new trust policy to every account without manual intervention, providing consistent role creation and low ongoing effort.
Go deeper
Related to this question
About these practice questions
One of 984 original SAP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.