Examkin

Question

Difficulty: MediumMulti-Account Management and Governance

A Solutions Architect is designing a multi-account environment on AWS for a global retail analytics platform. The company wants to enforce a policy where database administrators can only manage database resources within specific production and development accounts. In addition, the security team requires that all user authentication be centralized against their existing external identity provider, and that security monitoring configurations in member accounts cannot be modified by any local administrators. Which combination of actions should the Solutions Architect recommend to meet these requirements with the least administrative effort?

  1. A
    Configure an identity federation solution by creating individual IAM users with programmatic access in every AWS account, and write a custom synchronization script that maps corporate directory groups to local IAM group policies. Attach SCPs to the Organizational Units (OUs) to restrict security configuration modifications.
  2. B
    Configure AWS IAM Identity Center for centralized federation. Create Service Control Policies (SCPs) that restrict security modifications, and apply them to the root of the organization to restrict both the management account and all member accounts. Perform all daily administrative tasks using the management account's root user credentials to ensure full compliance.
  3. Configure AWS IAM Identity Center connected to the external identity provider for user access. Create Service Control Policies (SCPs) in AWS Organizations that prevent the modification of security configurations, and attach them to the member Organizational Units (OUs).Answer
  4. D
    Create IAM users in a centralized security account and configure cross-account IAM roles in the member accounts. Instruct users to log in using their IAM user credentials and manually assume the appropriate roles. Apply local IAM policies with explicit deny statements in each member account to prevent security modifications.

Answer

Configure AWS IAM Identity Center connected to the external identity provider for user access, and create Service Control Policies (SCPs) in AWS Organizations that prevent the modification of security configurations, attaching them to the member Organizational Units (OUs).
Centralizing authentication using AWS IAM Identity Center integrated with an external identity provider simplifies user access management without creating individual IAM users. Service Control Policies (SCPs) applied at the Organizational Unit (OU) level can restrict member accounts from modifying security configurations, implementing guardrails that even local administrators cannot bypass.

Step-by-Step Solution

1
Evaluate identity federation options to meet the centralized authentication requirement.
Identify AWS IAM Identity Center as the recommended tool to integrate with an external identity provider rather than creating static IAM users.
Centralized identity provider integration reduces credential management complexity and follows the principle of least privilege.
2
Determine the mechanism to enforce compliance and prevent local administrators from changing security settings.
Identify Service Control Policies (SCPs) in AWS Organizations attached to member Organizational Units (OUs) to act as permission guardrails.
SCPs apply to all users and roles in member accounts, including the local administrators (administrator/root permissions inside that account).
3
Combine the identity federation and SCP strategy to form a cohesive multi-account governance solution.
Select the option that configures AWS IAM Identity Center for external federation and uses SCPs attached to member OUs.
This combination achieves secure governance, centralized identity management, and enforces policy controls with minimal administrative effort.

Key Concept

Multi-Account Governance with AWS Organizations, AWS IAM Identity Center, and Service Control Policies (SCPs)
Rate this question

Topics

Multi-Account Management and Governance

More questions from this topic