All twenty engineers on a company's cloud team share the same administrator role, with full rights to every resource in every account, including billing and identity settings. Which change best applies authorization principles to cloud administration?

Authorization in cloud environments should follow least privilege, granting identities only the permissions required for their duties. Role-based access control implements this by defining roles around job functions, for example network operations, database administration, security auditing or billing, each with a scoped permission set, and assigning engineers to the roles they need, with highly privileged rights reserved for a few and ideally granted just in time. This limits the damage from compromised credentials or mistakes and supports separation of duties, such as keeping identity management apart from workload administration. Requiring a change ticket is a useful procedural control, but the shared role still lets every engineer perform any action, including bypassing the process, so it does not restrict authorization. Adding a billing role for finance staff improves their access but leaves all twenty engineers with full rights everywhere, which is the problem described. Rotating the role's credentials addresses leaver risk for shared secrets, but it neither narrows permissions nor attributes actions to individuals, and federated individual identities are preferable to shared credentials. Exam caveat: least privilege is the expected principle whenever broad, uniform administrative access appears in a scenario. Operational check: review each engineer's effective permissions after the change and confirm no one outside a small break-glass group holds full administrative rights.