A SaaS company grants developers AWS access, microservices API access, and on-premises servers access to S3 without long-lived keys. Access must scale by team attributes and support fine-grained policy decisions. Which authorization design unifies human, application, and system access with least privilege?
Select an answer to reveal the explanation.
Short Explanation
You've got humans, apps, and servers to manage, so you'll love swapping one master key for custom badges for each. Pair Identity Center with ABAC for your teams, add Verified Permissions for your APIs, and use Roles Anywhere for your servers to nail least privilege without long-lived keys.
Full Explanation
The unified design succeeds because it replaces long-lived keys with short-term federation for every identity type while keeping policy scalable and precise: IAM Identity Center federates developers with ABAC session tags like team and project so one policy scales instead of multiplying roles, Verified Permissions centralizes microservice authorization with Cedar policies for fine-grained allow decisions based on principal, resource and context, and IAM Roles Anywhere extends IAM trust to on-premises servers via X.509 certificates to vend temporary credentials for S3. The permission-sets-based design fails the scalability requirement because separate sets per team without ABAC attributes force manual duplication and drift instead of attribute-driven least privilege. The Cognito-based design fails the fine-grained authorization requirement because user pools and identity pools provide authentication and coarse temporary credentials but lack a centralized externalized policy engine for consistent API decisions. The instance-profile-based design fails the hybrid fact because instance profiles depend on EC2 instance metadata and cannot securely confer identity to off-AWS servers, even over VPN, leaving on-premises access without valid short-term trust. For exams, distinguish authentication services from externalized authorization and EC2-only mechanisms from on-premises mechanisms when the stem stresses attributes, fine granularity, and no static keys. To validate in practice, check that developers assume roles with team tags, APIs call IsAuthorizedWithToken with versioned Cedar policies, and servers present trusted CA certificates for Roles Anywhere with CloudTrail showing temporary AssumeRole sessions to S3.