A large organization is planning on AWS to host its resources. They have several autonomous departments that wish to use AWS. What could be the strategy to adopt for managing the accounts?

Answer options:

A.Use multiple VPCs in the account, one VPC for each department.
B.Use multiple IAM groups, one group for each department.
C.Use multiple IAM roles, one role for each department.
D.Use multiple AWS accounts, one account for each department.

Answer: D
Option A is incorrect since AWS recommends using a multiple account strategy for a company that wants multiple autonomous departments to access AWS resources and services.
Options B is incorrect since it would be an operational overhead to manage multiple IAM groups for multiple departments under one AWS account. This eliminates the isolation of resources and increases the blast radius in case of a security breach.
Option C is incorrect because creating separate IAM roles does not provide the best security practice for multiple autonomous departments working under a single account. There is a security concern for multiple environments (Dev, Test & Prod) under one account.
Option D is CORRECT because multiple accounts for each autonomous department are recommended as an AWS best practice. The approach can isolate workloads, limited visibility and minimize the blast radius (during security breach).
For more information on AWS Multi-Account best practices, kindly refer to the following URL:
https://d0.awsstatic.com/aws-answers/AWS_Multi_Account_Security_Strategy.pdf