A finance department insists on separate AWS accounts so the parks department cannot read tax databases. Why is account isolation an appropriate access-control choice?
Select an answer to reveal the explanation.
Short Explanation
Different accounts are like different vaults with different keys—parks staff never get a badge that opens the tax vault by default. IAM inside one shared account helps, but a mistaken wild-card policy can still expose everything. Account boundaries shrink that blast radius.
Full Explanation
AWS accounts are a hard security and billing boundary. Placing tax data in a finance account and parks workloads elsewhere reduces the chance that a broad IAM mistake in one team’s environment grants access to another team’s data. Identity policies in a single shared account remain important but are easier to misconfigure across teams. Separation does not imply sharing root across accounts.