Examkin

Question

Difficulty: HardMulti-Account Management and Governance

A Solutions Architect is designing a security governance framework for a healthcare technology provider. The provider has a multi-account environment managed through AWS Organizations, structured with separate OUs for Production, Testing, and Shared Services. The compliance team mandates that no IAM user or role within any member account—including administrative users—can create unencrypted Amazon EBS volumes or delete AWS KMS customer managed keys. Furthermore, the organization wants to manage human access centrally via an existing Microsoft Entra ID tenant without maintaining long-term security credentials in individual member accounts.

Which combination of actions should the Solutions Architect take to satisfy these governance and security requirements? (Select TWO.)

  1. Configure AWS IAM Identity Center to federate with Microsoft Entra ID as the external identity provider, and assign permission sets to manage user access across the member accounts.Answer
  2. Create a Service Control Policy (SCP) that denies kms:DeleteKey and ec2:CreateVolume actions if encryption is not enabled, and attach the policy to the organization's root or specific organizational units.Answer
  3. C
    Apply a Service Control Policy (SCP) to the organization's management account to block kms:DeleteKey and ec2:CreateVolume actions, ensuring the management account's administrative users are subject to the same compliance constraints.
  4. D
    Create individual IAM users with long-term credentials in each member account for every user in Microsoft Entra ID, and use IAM groups to map permissions.
  5. E
    Configure AWS Directory Service for Microsoft Active Directory inside each member account to directly synchronize user identities from the external cloud identity provider, mapping them to local IAM users.

Answer

Configure AWS IAM Identity Center to federate with Microsoft Entra ID and assign permission sets, and create a Service Control Policy (SCP) denying the unauthorized actions attached to the organization's root or organizational units.
Integrating AWS IAM Identity Center with Microsoft Entra ID allows central management of user access across multiple AWS accounts using temporary credentials, which avoids creating long-term IAM user credentials. At the same time, applying an SCP to the root or OUs prevents actions such as deleting KMS customer managed keys or creating unencrypted volumes across all member accounts, including administrative identities.

Step-by-Step Solution

1
Analyze the compliance requirement to restrict all administrative and standard users in member accounts from creating unencrypted volumes or deleting KMS keys.
Determine that Service Control Policies (SCPs) attached to the organization's root or organizational units (OUs) are the correct mechanism to enforce these mandatory guardrails across all member account roles.
SCPs define permission guardrails that even account administrators in member accounts cannot bypass.
2
Analyze the identity requirement to centralize access from Microsoft Entra ID without creating individual member account IAM users.
Determine that AWS IAM Identity Center integrated with Microsoft Entra ID as the external identity provider is the standard and secure solution.
AWS IAM Identity Center provides federated access using short-term credentials, avoiding the creation and maintenance of long-term IAM users.

Key Concept

Centralized governance and federated access in a multi-account structure using AWS Organizations SCPs and AWS IAM Identity Center.
Estimated Time:2m 30s
Rate this question

Topics

Multi-Account Management and Governance

More questions from this topic