A cloud administrator is reviewing how AWS Identity and Access Management building blocks fit together before onboarding a new team. Which two statements about IAM users, groups, roles and policies are correct? (Select TWO.)
- AAn IAM group is a collection of IAM users that lets the administrator attach one policy and have it apply to every user in the group. Correct
- BAn IAM role provides temporary credentials that a trusted identity or AWS service can assume, rather than belonging to one person. Correct
- CAn IAM policy is a monthly billing document that itemises the running cost of each IAM user and role in the account.
- DAn IAM group can be nested inside another IAM group so permissions cascade down through several group layers.
- EAn IAM user is the AWS account owner identity that always retains unrestricted access to every service in the account.
Why A is correct: Groups exist to manage permissions for many users at once, so attaching a policy to the group applies it to all members, which is accurate.
Why B is correct: Roles are designed to be assumed and deliver short-lived credentials to services or users without long-term keys, which correctly describes their purpose.
Why C is wrong: It is easy to confuse the word policy with cost, but an IAM policy is a JSON permissions document, not a record of charges.
Why D is wrong: Nesting sounds plausible from other systems, but IAM groups cannot contain other groups, so this capability does not exist.
Why E is wrong: This describes the root user, not an IAM user; an ordinary IAM user only has the permissions explicitly granted to it.