Examkin

Question

Difficulty: MediumMulti-Account Management and Governance

A financial technology startup is using AWS Organizations to manage multiple AWS accounts. The security team wants to enforce compliance across all member accounts by ensuring that AWS CloudTrail remains enabled and Amazon GuardDuty cannot be disabled or modified by member account administrators. Additionally, the startup wants to federate user access using their external Identity Provider (IdP) so that employees can access member accounts with their existing credentials without introducing long-term IAM credentials. Which strategy should the solutions architect recommend to meet these security and compliance requirements with the least operational effort?

  1. Enable AWS IAM Identity Center, configure federation with the external IdP, and assign permissions. Place the member accounts into Organizational Units (OUs) within AWS Organizations, and attach a Service Control Policy (SCP) to the OUs that denies API actions for disabling CloudTrail and GuardDuty.Answer
  2. B
    Create individual IAM users in each member account for every employee in the external IdP directory, configure IAM roles for cross-account access, and use AWS Organizations Service Control Policies (SCPs) to prevent member accounts from altering CloudTrail and GuardDuty.
  3. C
    Enable AWS IAM Identity Center and configure federation with the external IdP. Attach a Service Control Policy (SCP) to the AWS Organizations management account root user to prevent it from disabling CloudTrail and GuardDuty across all member accounts.
  4. D
    Deploy an AWS Directory Service AD Connector in each member account, generate individual IAM users with programmatic keys for each directory user, and use AWS Systems Manager to audit and automatically re-enable CloudTrail and GuardDuty if disabled.

Answer

Enable AWS IAM Identity Center, configure federation with the external IdP, and assign permissions. Place the member accounts into Organizational Units (OUs) within AWS Organizations, and attach a Service Control Policy (SCP) to the OUs that denies API actions for disabling CloudTrail and GuardDuty.
The correct strategy uses AWS IAM Identity Center to federate with the external IdP, which centralizes user management and avoids creating individual IAM users with long-term credentials in each member account. It also groups member accounts into Organizational Units (OUs) and applies Service Control Policies (SCPs) to deny disabling CloudTrail and GuardDuty. This enforces security guardrails across all member accounts with minimal operational effort.

Step-by-Step Solution

1
Centralize identity federation.
AWS IAM Identity Center is enabled and integrated with the external Identity Provider (IdP) to allow single sign-on access without creating individual IAM users or long-term credentials.
This meets the requirement of federating user access using existing credentials without introducing local IAM users.
2
Establish account structure in AWS Organizations.
Member accounts are grouped into Organizational Units (OUs) based on environment or governance needs.
This allows policies to be applied hierarchically and consistently across multiple accounts.
3
Enforce compliance using Service Control Policies (SCPs).
An SCP is attached to the OUs to explicitly deny administrative actions that would disable AWS CloudTrail or Amazon GuardDuty.
SCPs act as guardrails that apply to all users and roles within the member accounts, including the root user of those member accounts, ensuring compliance cannot be bypassed.

Key Concept

Centralized multi-account governance using AWS Organizations, Service Control Policies (SCPs), and AWS IAM Identity Center for external IdP federation.
Rate this question

Topics

Multi-Account Management and Governance

More questions from this topic