SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company has a multi-account AWS environment and wants to centralize the management of IAM roles. The security team needs to ensure that all IAM roles across all accounts trust the same identity provider (IdP) for federated access. The company uses AWS IAM Identity Center (successor to AWS SSO) for user management. Which solution should be implemented?
⚠ Common exam trap
Many candidates confuse SCPs as a mechanism to enforce trust policies, but SCPs cannot modify IAM role trust relationships; they only control the maximum permissions for IAM users and roles within an account.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use AWS IAM Identity Center to create permission sets that grant access to accounts. IAM Identity Center automatically creates and manages the necessary IAM roles with the IdP trust.
AWS IAM Identity Center (formerly AWS SSO) is designed to centralize user access across multiple AWS accounts. When you create permission sets in IAM Identity Center, it automatically provisions the necessary IAM roles in each target account with a trust policy that trusts the IAM Identity Center's own identity provider. This eliminates the need to manually create or manage IAM roles and their trust policies, ensuring all accounts use the same IdP for federated access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use AWS IAM Identity Center to create permission sets that grant access to accounts. IAM Identity Center automatically creates and manages the necessary IAM roles with the IdP trust.
Why this is correct
IAM Identity Center permission sets are provisioned into each account as IAM roles whose trust policy references the Identity Center instance, so every account trusts the same IdP automatically. This centralises role management and satisfies the requirement for uniform federated trust across all accounts.
- ✗
Use an SCP to require that all IAM roles trust the corporate IdP.
Why it's wrong here
An SCP is a permissions guardrail that filters which actions principals may perform; it cannot write or enforce a trust policy on an IAM role. It is tempting because SCPs govern all accounts from the organisation root, but they restrict permissions rather than configure role trust.
- ✗
Create IAM roles in each account with a trust policy that allows the corporate IdP.
Why it's wrong here
Per-account roles trusting the corporate IdP directly fragment role management and ignore IAM Identity Center, which already brokers federation. It is tempting because direct IdP trust is the classic pattern for a single account without a centralised identity service.
- ✗
Use AWS CloudFormation StackSets to deploy IAM roles with the IdP trust policy to all accounts.
Why it's wrong here
StackSets replicates a static trust policy into each account, so every role trusts the IdP directly rather than IAM Identity Center, bypassing centralised permission management. It is tempting because StackSets is the standard mechanism for deploying identical resources across many accounts.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 984 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.