A department placed every employee into a single IAM group with AdministratorAccess. What redesign best aligns with least privilege?
Select an answer to reveal the explanation.
Short Explanation
One giant AdministratorAccess group is like giving every staffer the master key to city hall. Split people into job-function groups — helpdesk, billing readers, builders — and hand each group only the keys their work actually needs.
Full Explanation
Replace a blanket AdministratorAccess group with job-function groups that grant only the permissions each role needs. One giant AdministratorAccess group is like giving every staffer the master key to city hall; split people into helpdesk, billing readers, builders, and similar groups with tailored keys. Keeping AdministratorAccess while disabling MFA to reduce friction worsens both authorization and authentication. Moving all employees onto the root user for simpler auditing destroys accountability. Attaching AdministratorAccess directly to each user instead of a group multiplies standing admin without solving least privilege. Distractors fail by preserving standing admin, by disabling MFA, by abusing root, or by scaling admin attachments per user. Exam caveat: break-glass admin paths may still exist but must be rare, MFA-bound, and monitored — not the default group for everyone. Operational check: inventory who is in the admin group today, design job-function policies, migrate users gradually, require MFA, alert on AdministratorAccess attachments, and re-certify group membership quarterly with managers. In practice, replace the blanket admin group in phases: create job-function groups first, move users with manager approval, and alert when AdministratorAccess is reattached.