Implementing Least Privilege with Emergency Break-Glass Access Across Accounts
A company wants to implement a least-privilege permission model across all AWS accounts. The security team needs to ensure that no IAM user has full administrator access. However, the operations team occasionally needs emergency access. Which solution meets these requirements?
Quick Answer
The answer is to configure AWS IAM Identity Center with permission sets that grant temporary elevated access and require approval for emergency access. This solution is correct because it enforces least privilege with emergency access across accounts by eliminating permanent IAM users or roles with full admin rights, instead relying on time-limited, scoped permissions that are activated only through an auditable approval workflow—a classic break-glass mechanism. On the AWS Certified Solutions Architect Professional SAP-C02 exam, this scenario tests your understanding of centralized identity management and the principle of just-in-time access, often appearing as a trap where candidates mistakenly choose IAM cross-account roles with long-lived credentials or fail to incorporate an approval step. Remember the mnemonic “Temporary + Approval = Break-Glass Control” to recall that emergency access must be both time-bound and gated by authorization, not just a static role switch.
⚠ Common exam trap
Candidates often confuse a static IAM role with a break-glass process (Option D) as sufficient for least privilege, but they overlook that without temporary credentials and approval workflows, the role grants persistent full admin access to anyone who can assume it, violating the least-privilege principle.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure AWS IAM Identity Center with permission sets that grant temporary elevated access, and require approval for emergency access.
AWS IAM Identity Center (formerly AWS SSO) allows you to define permission sets that grant temporary, scoped access to AWS accounts. By requiring approval for emergency access, you enforce a least-privilege model while still providing a controlled break-glass mechanism. This avoids permanent admin rights and ensures all elevated access is auditable and time-limited.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure AWS IAM Identity Center with permission sets that grant temporary elevated access, and require approval for emergency access.
Why this is correct
IAM Identity Center allows time-limited, auditable access elevation.
- ✗
Use an SCP that denies all IAM actions except those from a specific admin account.
Why it's wrong here
SCPs deny but do not grant; emergency access would still require a mechanism.
- ✗
Use an IAM password policy that requires multi-factor authentication for all users.
Why it's wrong here
Password policy does not limit privileges; it only enforces authentication.
- ✗
Create an IAM role in each account with full administrator access and use a break-glass process to assume it.
Why it's wrong here
This role would exist permanently and could be misused; also lacks time-bound controls.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 1,660 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SAP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company wants to implement a least-privilege security model across multiple AWS accounts. Which TWO services can help enforce this?
medium- A.AWS Key Management Service (KMS)
- ✓ B.AWS Organizations Service Control Policies (SCPs)
- C.AWS Config
- ✓ D.AWS Identity and Access Management (IAM) Access Analyzer
- E.AWS CloudTrail
Why B: AWS Organizations Service Control Policies (SCPs) are correct because they allow you to centrally control the maximum available permissions for all accounts in your organization, enabling a least-privilege model by restricting actions at the account level. SCPs act as a guardrail that applies to all IAM users, roles, and root users within an account, ensuring that even if a principal has broad IAM policies, the SCP can deny specific high-risk actions across the entire organization.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.