AWS Certified Solutions Architect - Professional

Create AWS Organizations service control policies (SCPs) that define which actions Security and DevOps teams can perform in member accounts. Attach SCPs to organizational units to enforce permission boundaries across accounts.

Create IAM roles in each member account with appropriate policies (SecurityAuditRole with ReadOnlyAccess, DevOpsAdminRole with AdministratorAccess for Dev/Staging and ReadOnlyAccess for Production). Configure trust policies to allow assumption from specific IAM roles in the Security and Shared Services accounts. Enable AWS CloudTrail organization trail to log all AssumeRole API calls. Optionally use IAM Access Analyzer to verify trust relationships don't allow unintended access.

Create IAM users in each member account for Security team members and DevOps team members. Grant appropriate permissions to each user and require MFA for authentication. Use AWS CloudTrail to log all API activity by these users.

Use AWS SSO (IAM Identity Center) to create permission sets for Security Auditors and DevOps teams. Assign permission sets to appropriate accounts and OUs, configure session duration policies, and use CloudTrail to log SSO authentication and role assumption events.