Examkin

Question

Difficulty: Very hardMulti-Account Management and Governance

A financial services company is designing a secure multi-account environment using AWS Organizations. The architecture requires that all member accounts enforce continuous security auditing. Specifically, administrators of the member accounts must be blocked from stopping, modifying, or deleting the organizational AWS CloudTrail. Additionally, the company must centralize access control for its 5,000 corporate identities currently managed in an external Okta directory, ensuring they do not use local IAM credentials. The security controls must not restrict administrative or billing operations within the Organizations management account.

Which two actions should a solutions architect take to meet these governance requirements? (Select TWO.)

  1. Create an SCP that denies the `cloudtrail:StopLogging`, `cloudtrail:UpdateTrail`, and `cloudtrail:DeleteTrail` actions, and attach the SCP to the root of the organization.Answer
  2. Enable AWS IAM Identity Center in the management account, connect it to the Okta directory using SAML 2.0 and SCIM, and assign permission sets to corporate groups to manage target member accounts.Answer
  3. C
    Create an SCP that denies the `cloudtrail:StopLogging`, `cloudtrail:UpdateTrail`, and `cloudtrail:DeleteTrail` actions, and attach it directly to the Organizations management account to prevent its root user from disabling auditing.
  4. D
    Create individual IAM users with long-term access keys in the Organizations management account for each corporate identity, and configure cross-account IAM roles for member account access.
  5. E
    Provision IAM users with administrative permissions in each member account for the corporate identities, and assign them to an IAM group with restricted permissions to prevent local credential modifications.

Answer

Create an SCP that denies the CloudTrail modification actions and attach it to the root of the organization, and enable AWS IAM Identity Center integrated with Okta to manage access.
Attaching the SCP to the root of the organization restricts CloudTrail modification actions on all member accounts by inheritance, but because SCPs do not apply to the management account, administrative operations in the management account remain unrestricted. Integrating AWS IAM Identity Center with Okta using SAML 2.0 and SCIM ensures centralized identity federation and dynamic access provisioning to member accounts without creating individual local IAM users or long-term credentials.

Step-by-Step Solution

1
Evaluate the CloudTrail protection requirement.
Identify that a Service Control Policy (SCP) denying delete, stop, and update actions is required to prevent member account administrators from altering CloudTrail.
SCPs allow organization-wide control over actions that member account administrators can perform.
2
Determine where to attach the SCP to meet the management account exemption.
Attach the SCP to the organization root. The policy will inherit down to all member accounts but will not restrict the management account itself.
SCPs do not apply to the Organizations management account.
3
Address the centralized identity requirement for Okta users.
Use AWS IAM Identity Center to federate with the external Okta directory using SAML 2.0 and SCIM.
This avoids creating local IAM users with long-term keys and automates user provisioning.
4
Configure permissions for the federated users.
Map Okta groups to IAM permission sets in the target member accounts.
This enforces centralized access control in a multi-account environment.

Key Concept

Applying Service Control Policies (SCPs) in AWS Organizations and configuring AWS IAM Identity Center for external identity provider integration.
Estimated Time:3m 0s
Rate this question

Topics

Multi-Account Management and Governance

More questions from this topic