A user needs full access to manage all resources in a resource group but must NOT be able to assign roles to others. Which built-in role fits?
A.Owner
Owner can also delegate access — the requirement explicitly excludes that.
B.Contributor
Contributor manages resources without access-granting rights. Correct.
C.Reader
Reader is view-only — can't manage anything.
D.User Access Administrator
User Access Admin is the inverse — manages access, not resources.
Why this answer
The key built-in trio plus one: Owner = everything INCLUDING role assignments; Contributor = manage all resources but CANNOT grant access; Reader = view only; User Access Administrator = manage access only. 'Manage everything except RBAC' = Contributor.
Correct answer: B · Last reviewed 2026-02-14
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Identity & Governance practice session.
Practice Identity & Governance