A city council policy requires separating billing owners from workload administrators so the same person cannot both pay invoices and change production IAM. Which architecture best enforces that separation of duties?
Select an answer to reveal the explanation.
Short Explanation
Think of the finance clerk and the building electrician—different badges on purpose. Separate accounts or tightly scoped roles keep billing owners off production IAM and keep workload admins out of payment controls. One mega-admin, a shared root password, or dark CloudTrail are how separation of duties collapses.
Full Explanation
City council separation-of-duties policy is best enforced by separate AWS accounts or tightly scoped IAM roles so billing and finance principals cannot administer production workloads and workload administrators lack permissions to modify payment instruments and invoices. Isolating who can pay from who can change IAM and infrastructure reduces fraud risk and accidental privilege concentration—exactly the civic control intent behind dual custody of funds and systems.
Giving every administrator AdministratorAccess plus Billing full access in one shared account fails because it collapses both duties into the same principals and maximizes blast radius. Storing the root password in a shared chat channel fails conceptually: root is not a team role, shared secrets destroy non-repudiation, and either team can unilaterally unlock billing and identity. Disabling CloudTrail so neither team can review IAM or payment changes fails because it removes the audit evidence needed to prove separation was respected and to investigate violations.
Exam caveat: account separation alone is incomplete if finance users are later invited into workload accounts with AdministratorAccess, or if workload admins retain billing-modify IAM in the payer account. Operational check: map Billing/Cost Management actions to finance roles only, deny those actions to workload admin roles (via IAM and/or SCPs), keep CloudTrail organization trails enabled, and periodically review who can modify payment methods versus who can change production IAM.