Examkin

Question

Difficulty: MediumMulti-Account Management and Governance

A logistics company is designing a multi-account environment on AWS using AWS Organizations. The company has several business units, each requiring separate development and production environments. To comply with corporate security standards, the solutions architect must implement a solution that enforces federated identity management via the company's external identity provider. Additionally, the solution must guarantee that security auditing cannot be disabled by stopping or deleting AWS CloudTrail trails in any member account. Which two actions should the solutions architect take to meet these requirements? (Select two.)

  1. Configure AWS IAM Identity Center to federate with the external identity provider, and assign permission sets to centralized groups.Answer
  2. Implement a service control policy (SCP) that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail actions, and attach it to the Organizational Units (OUs) containing the member accounts.Answer
  3. C
    Provision individual IAM users with long-term security credentials in each member account to map to external directory accounts, and delegate administrative roles.
  4. D
    Use the management account root user credentials to deploy inline policies directly to all accounts to restrict CloudTrail modifications.
  5. E
    Establish federated access by creating matching IAM users in the management account and using cross-account roles to access member accounts.

Answer

Configure AWS IAM Identity Center to federate with the external identity provider, and implement a service control policy (SCP) that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail actions attached to the Organizational Units (OUs) containing the member accounts.
Centralizing identity access using AWS IAM Identity Center federated with an external identity provider allows administrative access without managing individual IAM users. Additionally, creating and applying a service control policy (SCP) that denies CloudTrail modification/deletion actions (cloudtrail:StopLogging and cloudtrail:DeleteTrail) at the Organizational Unit level prevents member account administrators from disabling auditing, satisfying the compliance requirements securely.

Step-by-Step Solution

1
Set up centralized identity federation.
AWS IAM Identity Center is configured to synchronize and authenticate users against the external identity provider.
This removes the need to create static IAM users in individual member accounts and enables single sign-on using temporary security credentials.
2
Enforce auditing compliance across the Organization.
A service control policy (SCP) is drafted with explicit Deny rules for cloudtrail:StopLogging and cloudtrail:DeleteTrail.
SCPs allow the organization's administration to set guardrails that member account administrators cannot override.
3
Apply the guardrails to the appropriate scope.
The SCP is attached to the OUs containing the member accounts.
This ensures the guardrails are inherited by all existing and future accounts under those OUs without impacting the management account itself.

Key Concept

AWS multi-account governance using AWS Organizations, Service Control Policies (SCPs), and AWS IAM Identity Center.

Alternative Method

An alternative method is to use AWS Control Tower to set up the landing zone, which automatically configures AWS IAM Identity Center and applies default guardrails (implemented as SCPs) that prevent disabling CloudTrail across the managed accounts.
Estimated Time:2m 0s
Rate this question

Topics

Multi-Account Management and Governance

More questions from this topic