Examkin

Question

Difficulty: Very hardMulti-Account Management and Governance

An enterprise is designing a secure multi-account AWS environment using AWS Organizations to comply with regulatory standards. The architecture contains a management account and multiple member accounts grouped into OUs, including a Production OU and a Development OU.

The security team has specified the following requirements:
1. Centralize administrative access management by integrating with the enterprise's corporate Active Directory.
2. Prevent administrators in any member account from deleting or modifying a specific compliance auditing IAM role named SecurityAuditRole.
3. Restrict member accounts under the Development OU to only run Amazon EC2 and Amazon S3 workloads, while ensuring that the management account is never blocked from performing administrative recovery actions.

Which combination of actions will meet these requirements with the least operational overhead?

  1. A
    Create individual IAM users in the management account for all corporate directory users and configure cross-account roles in each member account. Apply local IAM policies in each member account that prevent administrators from deleting or modifying the SecurityAuditRole. Create an SCP that denies access to all services except Amazon EC2 and Amazon S3, and attach it to the Development OU.
  2. B
    Enable AWS IAM Identity Center and configure Active Directory synchronization. Create an SCP that denies the deletion or modification of the SecurityAuditRole and attach it to the organization root. In the SCP's condition block, explicitly exclude the root user of the management account from the deny statement, and use the management account's root user credentials for daily administrative tasks to bypass the SCP limits.
  3. Enable AWS IAM Identity Center and configure Active Directory synchronization for user federation. Create an SCP that denies the deletion or modification of the SecurityAuditRole and attach it to the organization root. Create a second SCP that denies access to all services except Amazon EC2 and Amazon S3, and attach it to the Development OU.Answer
  4. D
    Create individual IAM users in each member account and synchronize them with the corporate Active Directory using an identity agent. Create an SCP that denies the deletion or modification of the SecurityAuditRole and attach it to the organization root. To bypass the SCP restrictions in the Development OU, instruct developers to log in using the member account root user credentials, which are exempt from SCP policies.

Answer

Enable AWS IAM Identity Center and configure Active Directory synchronization for user federation. Create an SCP that denies the deletion or modification of the SecurityAuditRole and attach it to the organization root. Create a second SCP that denies access to all services except Amazon EC2 and Amazon S3, and attach it to the Development OU.
The correct answer uses AWS IAM Identity Center to federate user identity from the on-premises Active Directory, matching AWS best practices for centralized identity management. To protect the auditing IAM role across all member accounts, a Service Control Policy (SCP) is attached to the root of the organization. Because SCPs do not apply to the management account, the management account administrators can still manage the role if necessary for recovery. Restricting services via a separate SCP attached to the Development OU ensures only the workloads within that OU are constrained, satisfying the requirements with minimal operational overhead.

Step-by-Step Solution

1
Identify the proper service for centralizing authentication with corporate identity providers in a multi-account setup.
AWS IAM Identity Center is selected over manual IAM user creation.
Reduces operational overhead and eliminates long-term credentials.
2
Determine the mechanism to protect the auditing IAM role across all member accounts.
An SCP denying modifications to the role is attached to the organization root.
SCPs apply to all member accounts but naturally do not restrict the management account, preserving recovery access.
3
Apply service restrictions specifically to the Development OU.
A separate SCP denying unauthorized services is attached directly to the Development OU.
Ensures developers are restricted to EC2 and S3 without affecting accounts in other OUs or the management account.

Key Concept

Centralized multi-account identity federation and Service Control Policy scoping rules
Rate this question

Topics

Multi-Account Management and Governance

More questions from this topic