A healthcare company manages 400 developers across 30 projects using separate IAM roles per project, and role sprawl causes frequent policy updates. New projects must auto-grant access when job function and project tags match resource tags. Which authorization strategy enforces scalable project access with tags?
Select an answer to reveal the explanation.
Short Explanation
You're drowning in roles and need access that sorts itself. ABAC lets matching tags do the granting so new projects just work.
Full Explanation
The correct strategy succeeds because a single ABAC policy using aws:PrincipalTag and resource tags for both job function and project enforces dynamic authorization without creating new roles, so when federation passes session tags for engineers the condition keys for project equality plus job-function check automatically extend to new projects with correct tags, eliminating role sprawl and frequent policy edits while preserving least-privilege isolation required in healthcare. The reusable RBAC approach with job-function to owner matching fails by concept of granularity because it validates only department identity and omits the project equality check, so an engineer could access all projects sharing the job function and violate project isolation despite scaling well. The ABAC variant that still requires administrator updates for each new project fails by concept of scalability and automation because it retains a manual allow-list step, contradicting the requirement that new projects auto-grant access purely from tag match. The per-project tagged-role federation approach fails by concept of manageability because although session project tags correctly enforce isolation, maintaining 30-plus roles and trust policies preserves the sprawl and update burden the scenario seeks to eliminate, rather than consolidating to one policy. For exams, distinguish ABAC tag-match conditions from RBAC job roles and watch for distractors that include tags but reintroduce per-resource or per-project policy maintenance. Practically, verify in IAM Policy Simulator with principal tags, confirm IdP passes project and job-function session tags via sts:TagSession, and audit that resources are consistently tagged on creation with enforcement via SCPs or tag policies.