SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company has a multi-account AWS environment with a central shared services account. The company wants to provide a self-service portal for developers to request temporary AWS credentials for specific roles in various accounts. The credentials must be generated without creating IAM users and must be auditable. Which solution meets these requirements?
⚠ Common exam trap
The trap here is assuming that Cognito identity pools are suitable for developer access to AWS accounts, when they are primarily for customer-facing applications.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use AWS IAM Identity Center (successor to AWS Single Sign-On) to assign users to permission sets that map to IAM roles in target accounts.
AWS IAM Identity Center is designed to centrally manage access to multiple AWS accounts and provides temporary credentials for IAM roles without IAM users. It supports self-service via the AWS access portal and logs all access in CloudTrail, meeting the auditable requirement with minimal operational overhead.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create IAM users in each account and use AWS STS AssumeRole to obtain temporary credentials.
Why it's wrong here
Creating IAM users in each account violates the requirement to avoid IAM users and increases management overhead. While AssumeRole provides temporary credentials, the underlying IAM users are long-term credentials that must be managed and rotated, and they are not ideal for a self-service portal.
- ✓
Use AWS IAM Identity Center (successor to AWS Single Sign-On) to assign users to permission sets that map to IAM roles in target accounts.
Why this is correct
IAM Identity Center allows centralized management of user access and generates temporary credentials for IAM roles in target accounts without creating IAM users. It provides an audit trail through AWS CloudTrail and integrates with external identity providers, meeting the self-service and auditable requirements.
- ✗
Use AWS Cognito user pools to authenticate developers and issue temporary AWS credentials via Cognito identity pools.
Why it's wrong here
Cognito identity pools can issue temporary AWS credentials, but they are designed for application end-users, not for developer access to AWS accounts. Mapping Cognito identities to IAM roles across multiple accounts requires complex configuration and does not provide the same centralized permission management as IAM Identity Center.
- ✗
Deploy a custom portal that uses AWS Lambda to call sts:AssumeRole and returns credentials to the developer.
Why it's wrong here
A custom portal using Lambda to assume roles can generate temporary credentials, but it requires significant development and maintenance effort. It also lacks built-in auditing and integration with identity providers, making it less auditable and more operationally complex than a managed service.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 984 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.