Fifteen engineers belong to the owners team of an HCP Terraform organization, mostly so they can manage workspaces for their own applications. What change best follows least privilege?
Select an answer to reveal the explanation.
Short Explanation
Your owners team is the master key ring, and fifteen copies is about thirteen too many. Keep a couple for emergencies and give everyone else project or workspace permissions through their own teams. Two-factor makes logins safer, but it doesn't make an owner any less of an owner.
Full Explanation
Members of the owners team have full administrative access to the organization: every workspace and project, policies, VCS connections, teams and tokens. Least privilege reserves that for a small number of administrators, ideally with break-glass procedures, while day-to-day access comes from teams granted project permissions or workspace roles, including custom permission sets, sized to what each group manages. This limits the damage from a compromised account and makes access reviews meaningful. Two-factor authentication strengthens how users sign in but does not reduce what an owner can do once signed in. Emptying the owners team is not possible, because the team must keep at least one member, and an organization without administrators could not be managed. Sensitive variables are write-only for everyone, owners included, but that setting hides values; it has no effect on owners' ability to change workspace settings, permissions or policies. Exam caveat: project-level permissions can delegate creation and administration of workspaces within a project, which covers most of the reasons engineers were made owners. Operational check: review the owners team membership, move each engineer into an appropriate team, and confirm they can still manage their own workspaces but not organization settings.