ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

Subject-based RBAC assigns permissions to collections of subjects that share a common job function, rather than granting rights directly to individual users or defining policies on every resource. In AWS, the closest analogue to an RBAC role is an IAM group (or an IAM role assumed by many users). By attaching the required permission policies to a dedicated IAM group for each team and adding users to the appropriate group, the engineer centralizes permission management and aligns access with job roles. Granting policies to individual users bypasses the role concept and becomes hard to maintain. Placing separate resource-based policies or ACLs on every S3 bucket and Glue job focuses on the objects, not the subjects, and scales poorly as resources grow. Therefore, creating team-specific IAM groups (or roles) with the needed permissions is the best way to implement subject-based RBAC in AWS.