Examkin

Question

Difficulty: MediumMulti-Account Management and Governance

A logistics company is designing a multi-account strategy using AWS Organizations. The IT department wants to implement centralized user access for administrative staff by integrating their existing external identity provider. Furthermore, the security team requires that no member account is allowed to disable AWS CloudTrail logging. Which solution should a solutions architect recommend to satisfy these requirements?

  1. Configure AWS IAM Identity Center federated with the external identity provider, and attach a Service Control Policy (SCP) that denies the cloudtrail:StopLogging action to the organizational unit containing the member accounts.Answer
  2. B
    Create individual IAM users in each member AWS account mapping to external identities, and attach a Service Control Policy (SCP) that denies the cloudtrail:StopLogging action to the root of the organization to enforce limits globally.
  3. C
    Configure AWS IAM Identity Center for normal users, but utilize the management account's root user credentials for daily multi-account administration. Apply local IAM policies to deny CloudTrail changes within each member account.
  4. D
    Create IAM users in the management account for all administrative staff, configure trust relationships for cross-account roles, and configure a Service Control Policy (SCP) on the management account itself to restrict log modification.

Answer

Configure AWS IAM Identity Center federated with the external identity provider, and attach a Service Control Policy (SCP) that denies the cloudtrail:StopLogging action to the organizational unit containing the member accounts.
Integrating AWS IAM Identity Center with an external identity provider simplifies identity management by using federation rather than local credentials. Additionally, attaching an SCP to the member accounts' organizational unit successfully prevents any user or role inside those member accounts from stopping CloudTrail logging, guaranteeing compliance.

Step-by-Step Solution

1
Select the centralized authentication mechanism.
AWS IAM Identity Center is configured and integrated with the external identity provider to enable federated access without creating local IAM users.
Centralized identity management reduces credentials overhead and simplifies access lifecycle management.
2
Define the policy structure to prevent disabling CloudTrail.
Create a Service Control Policy (SCP) with a Deny effect on the cloudtrail:StopLogging action.
SCPs are the primary mechanism in AWS Organizations to set maximum permissions boundaries across accounts.
3
Apply the policy to the multi-account hierarchy.
Attach the SCP to the organizational unit containing the member accounts.
Applying the SCP at the organizational unit level ensures enforcement across all member accounts in that unit while avoiding restrictions on the management account's root operational functions if they are kept separate.

Key Concept

Centralized multi-account governance using AWS Organizations SCPs and AWS IAM Identity Center.
Rate this question

Topics

Multi-Account Management and Governance

More questions from this topic