A township finance team and parks team share one AWS account and keep colliding on permissions when both use shared admin users. How should the architect structure authorization?
Select an answer to reveal the explanation.
Short Explanation
Shared admin logins are like one master badge that every desk passes around—when something breaks, you cannot tell who did what. Put finance and parks into groups or roles with only the rights each job needs. Least privilege beats one overloaded admin account.
Full Explanation
Within a shared account, flexible authorization uses IAM users (or federated identities), groups, and roles with policies scoped to job functions so finance and parks receive only the permissions they require. Shared AdministratorAccess or root credentials amplify blast radius and audit gaps. Disabling IAM in favor of guest OS accounts does not secure AWS API and console access.