Examkin

Question

Difficulty: MediumMulti-Account Management and Governance

A Solutions Architect is designing a secure multi-account environment for a growing enterprise. The company's security policy requires centralized access management for employee identities, enforcement of compliance guardrails across all member accounts in the organization, and preventing individual account administrators from disabling logging or modifying centralized security resources. Which architectural strategy best meets these requirements?

  1. Configure AWS IAM Identity Center for centralized single sign-on access, and use AWS Organizations to apply a Service Control Policy (SCP) at the organizational unit level that denies CloudTrail deletion and S3 log bucket modifications.Answer
  2. B
    Create individual IAM users in each member account with long-term credentials synchronized to the corporate directory, and use IAM policies in each account to restrict access to log settings.
  3. C
    Use the management account root credentials to configure administrative access across member accounts, and attach an IAM policy to the root user to enforce logging compliance.
  4. D
    Configure federated access using individual IAM users in the management account, and store administrative access keys as plaintext in Systems Manager Parameter Store parameters for automated compliance checking.

Answer

Configure AWS IAM Identity Center for centralized single sign-on access, and use AWS Organizations to apply a Service Control Policy (SCP) at the organizational unit level that denies CloudTrail deletion and S3 log bucket modifications.
The correct strategy combines AWS IAM Identity Center for centralized, federated access (avoiding individual IAM users and long-term credentials) with AWS Organizations SCPs applied at the OU level to prevent member account administrators from disabling CloudTrail or altering S3 logging resources.

Step-by-Step Solution

1
Implement centralized identity management.
Enable AWS IAM Identity Center, integrating it with the enterprise identity provider to allow centralized authentication and role assignment without provisioning long-term IAM user credentials.
This establishes federated access control in line with security best practices.
2
Enforce multi-account governance guardrails.
Use AWS Organizations to define a Service Control Policy (SCP) that explicitly denies actions like `cloudtrail:StopLogging`, `cloudtrail:DeleteTrail`, and `s3:DeleteBucket` on the centralized log repository.
SCPs act as organizational guardrails that apply to all principal identities in member accounts, including the root user of those accounts.
3
Apply the policy to the organization structure.
Attach the SCP to the relevant Organizational Units (OUs) containing the member accounts.
This ensures the guardrails are inherited by all accounts within the targeted OUs without manually configuring permissions in each individual account.

Key Concept

Centralized multi-account governance using Service Control Policies and federated identity integration via AWS IAM Identity Center.
Rate this question

Topics

Multi-Account Management and Governance

More questions from this topic