CLF-C02 Practice Question 23: IAM User Groups

An IAM user group is a collection of IAM users. When you attach an identity-based policy to the group, every user in the group receives its permissions automatically. A new developer gets access by being added to the group, and when someone changes jobs you remove them from the group instead of editing their individual permissions.

Option B works on day one but becomes unmanageable: every change to the permissions must be repeated on 25 separate users, and copies drift apart. Option C destroys individual accountability, actions can no longer be traced to a person, and forces a password change every time anyone leaves. Option D is a common misconception: service control policies set the maximum permissions available to accounts in an organization, but they never grant permissions on their own; users still need identity-based policies.

Reference: IAM user groups