Examkin

Question

Difficulty: MediumMulti-Account Management and Governance

A company is designing a multi-account environment on AWS using AWS Organizations. The company has several business units, each requiring its own dedicated account under a specific OU. The security team requires centralized user authentication using the company's external identity provider. Additionally, the security team must prevent any member account from leaving the organization. Which of the following actions should the solutions architect take to meet these requirements? (Select TWO.)

  1. Configure AWS IAM Identity Center connected to the external identity provider to centrally manage user access across all accounts.Answer
  2. Apply a Service Control Policy (SCP) at the root level of the organization that denies the organizations:LeaveOrganization API action.Answer
  3. C
    Create individual IAM users in each member account and configure SAML 2.0 federation mapping for each corporate user.
  4. D
    Apply a Service Control Policy (SCP) to the organization's management account to restrict the administrative actions of its root user.
  5. E
    Create IAM users in the management account with administrative permissions and configure cross-account roles to access each member account.

Answer

Configure AWS IAM Identity Center connected to the external identity provider, and apply a Service Control Policy (SCP) at the root level that denies the organizations:LeaveOrganization action.
Integrating AWS IAM Identity Center with the external identity provider is the native, scalable method to grant federated access to AWS accounts without manual credential configuration. Applying a Service Control Policy that denies the organizations:LeaveOrganization action at the root level ensures that no member account can detach itself from the organization's governance boundary.

Step-by-Step Solution

1
Address the centralized identity requirement.
By using AWS IAM Identity Center, the solutions architect integrates the corporate external identity provider once to provide single sign-on access to all AWS accounts.
This centralizes user access and avoids the management overhead of creating local IAM users.
2
Address the multi-account governance and organization control requirement.
By applying an SCP denying organizations:LeaveOrganization at the root of the organization, the constraint is inherited by all member accounts.
SCPs are the standard mechanism to enforce organizational boundaries and security controls across accounts.

Key Concept

Centralized multi-account governance using AWS Organizations SCPs and AWS IAM Identity Center.
Rate this question

Topics

Multi-Account Management and Governance

More questions from this topic