A county separates production and nonproduction AWS accounts so developers do not hold production IAM permissions by default. How should production access work when needed?
Select an answer to reveal the explanation.
Short Explanation
Nonprod is the practice field; production is the locked stadium. Developers live in nonprod by default and only assume a production role—with MFA and eyes on the logs—when they must. Standing prod admin on every laptop erases the account split.
Full Explanation
Splitting prod and nonprod accounts enables a default-deny posture for production. Elevated access should use role switching or temporary Identity Center assignments with strong controls (MFA, short sessions, auditing), not standing AdministratorAccess distributed to developer workstations or routine root use. Automatic full-admin mirroring from nonprod into prod defeats isolation.