A fintech app needs fine-grained user actions like transfer:approve for tellers versus managers, with policy simulation and audit trails, without embedding complex checks in code across microservices. Thousands of decisions per second must scale. Which authorization approach should the architect design to externalize human and application access decisions?
Select an answer to reveal the explanation.
Short Explanation
Hardcoded if-statements never scale for approvals. Externalization moves your rulebook out of code into a fast decision engine.
Full Explanation
Amazon Verified Permissions provides centralized policy stores with Cedar policies for application-level fine-grained authorization, APIs for is-authorized decisions, policy simulation, and decision logs, which removes embedded logic and scales for human and system callers with auditable outcomes. Identity Center permission sets fail by concept because they authorize AWS console and API access for workforce users, not application actions like transfer approve. IAM Roles Anywhere fails by concept because it extends IAM to on-premises workloads with X.509 trust anchors rather than evaluating application Cedar policies. IAM paths and groups fail by concept because they organize IAM principals and permissions, not externalized application authorization with simulation. Exam caveat is to separate AWS access management from application authorization decisions, and practical check is to test Cedar policies in the simulator and confirm decision logs flow to audit storage.