A city maps Active Directory groups to AWS IAM Identity Center permission sets for Management Console access across multiple accounts. What is the main advantage of this design?
Select an answer to reveal the explanation.
Short Explanation
One city directory group can unlock the right AWS doors in many accounts without minting a new IAM user everywhere. Identity Center permission sets are that mapping layer. You keep MFA and logging; you just stop cloning IAM users account by account.
Full Explanation
AWS IAM Identity Center centralizes workforce authentication and authorization with permission sets assigned to users or groups—commonly synchronized from Active Directory—across AWS organization accounts. That model reduces per-account IAM user sprawl while supporting least-privilege console access. It does not eliminate MFA or CloudTrail requirements, nor does it require shared AdministratorAccess users.