SAP-C02 Practice Test 5

An engineering organization has 800 project teams working across 200 AWS accounts. Access is granted through AWS IAM Identity Center federated to the company's external identity provider, which already carries a costCenter and an environment attribute for every employee.

The current model creates one permission set per team per environment. There are now more than 3,000 permission sets, each with an inline policy that lists resource ARNs, and the identity team spends most of its week creating permission sets, editing policies, and re-assigning people who move between teams. Every resource in the estate is tagged with the owning cost centre and its environment, and tagging is enforced.

The target state is that an engineer can act only on resources whose tags match their own attributes, that moving someone between teams takes effect at their next sign-in with no change to anything in AWS, and that the number of permission sets to maintain collapses.

What should the solutions architect implement?