A Solutions Architect is establishing a multi-account AWS environment for a financial organization. The compliance guidelines require that no member accounts can modify VPC flow logs or delete customer managed keys. Additionally, all administrative access to the AWS accounts must be mapped directly to the organization's existing corporate identity provider. Which two actions should the Solutions Architect implement to meet these requirements?
- Configure AWS IAM Identity Center and federate it with the corporate identity provider to centrally manage cross-account permissions.Answer
- Create and attach an SCP to the organizational units containing the member accounts to deny actions such as deleting flow logs and scheduling key deletion.Answer
- CCreate individual IAM users in the management account for each corporate employee, and have them assume roles in the member accounts using long-term credentials.
- DCreate SCPs that block these actions and apply them to the management account to restrict its root user credentials.
- EGenerate root access keys for the management account and use them in a custom script to automatically remediate any configuration changes in the member accounts.
Answer
Configure AWS IAM Identity Center integrated with the corporate identity provider, and apply SCPs at the organizational unit level to restrict member accounts.
Establishing centralized authentication through AWS IAM Identity Center integrated with the corporate identity provider represents the best practice for federated access. Enforcing compliance restrictions through SCPs attached to organizational units ensures that policy boundaries are enforced on all member accounts automatically.
Step-by-Step Solution
Key Concept
Multi-Account Governance with SCPs and IAM Identity Center