A financial services startup is establishing its AWS cloud architecture. The organization needs to centralize authentication using its external Okta directory and restrict member accounts from modifying or deleting baseline security auditing configurations. Additionally, the security policy prohibits the use of long-term credentials for daily operations. Which two actions should be performed to establish this administrative governance model? (Select TWO.)
- Integrate AWS IAM Identity Center with the Okta directory to allow users to sign in and assume permission sets using temporary security credentials.Answer
- Deploy a Service Control Policy (SCP) at the root level of the organization to prevent member accounts from stopping or modifying CloudTrail logging configurations.Answer
- CCreate individual IAM users in each member account with long-term security credentials and configure local trust policies for Okta integration.
- DConfigure the daily administrative tasks to be run directly by using the management account's root user credentials to ensure complete oversight.
- EConfigure the API access keys for the external identity provider by storing them as plaintext String parameters in Systems Manager Parameter Store across all member accounts.
Answer
Integrating AWS IAM Identity Center with Okta for temporary credential generation, and deploying an organization-level Service Control Policy to protect CloudTrail logging configurations.
Integrating AWS IAM Identity Center with the external directory allows federated users to obtain short-term credentials, eliminating static credential storage. Implementing a Service Control Policy at the organization root enforces compliance and protects logging systems from modifications by administrators in individual member accounts.
Step-by-Step Solution
Key Concept
Centralized identity federation and multi-account security guardrails using Service Control Policies.