Examkin

Question

Difficulty: MediumMulti-Account Management and Governance

A company is designing a secure multi-account architecture using AWS Organizations. The security team requires that all employee authentication be integrated with their existing enterprise Identity Provider (IdP) for centralized access control. Additionally, member account administrators must be prevented from disabling or deleting AWS CloudTrail resources.

Which solution should a Solutions Architect recommend to meet these requirements?

  1. A
    Create individual IAM users in each member account with long-term credentials mapped to each employee in the external IdP, and configure local IAM policies to restrict CloudTrail access.
  2. Enable AWS IAM Identity Center and configure it to federate with the external IdP. Apply a Service Control Policy (SCP) to the organization's root or organizational units (OUs) that denies the cloudtrail:StopLogging and cloudtrail:DeleteTrail actions.Answer
  3. C
    Enable AWS IAM Identity Center for federation. Attach a Service Control Policy (SCP) to the organization's management account to prevent CloudTrail modifications, and require security administrators to use the management account's root credentials for daily compliance monitoring.
  4. D
    Configure AWS IAM Identity Center for federation with the external IdP. Store the integration's sensitive API credentials as a plaintext parameter in Systems Manager Parameter Store, and allow administrators in member accounts to modify local IAM policy settings to restrict CloudTrail.

Answer

Enable AWS IAM Identity Center and configure it to federate with the external IdP. Apply a Service Control Policy (SCP) to the organization's root or organizational units (OUs) that denies the cloudtrail:StopLogging and cloudtrail:DeleteTrail actions.
The correct solution involves configuring AWS IAM Identity Center to federate authentication with the company's external Identity Provider (IdP). This provides a centralized single sign-on experience without manual creation of IAM users. To prevent member account administrators from disabling or deleting AWS CloudTrail, a Service Control Policy (SCP) must be applied at the organization's root or OU level. SCPs apply to all IAM users and roles in member accounts, including the root user of those accounts, ensuring compliance cannot be bypassed locally.

Step-by-Step Solution

1
Establish centralized authentication with the external IdP using AWS IAM Identity Center.
Employees can authenticate using their existing enterprise directory credentials to access authorized AWS accounts.
Centralizing authentication reduces administrative overhead and eliminates the need to manage individual IAM users.
2
Write a Service Control Policy (SCP) that explicitly denies actions like cloudtrail:StopLogging and cloudtrail:DeleteTrail.
A policy document is created containing the explicit deny rule.
SCPs serve as permission guards that define the maximum permissions for member accounts.
3
Attach the Service Control Policy (SCP) to the organization's root or specific OUs containing the member accounts.
The restriction is enforced across all users and roles within the targeted member accounts, including account administrators.
This ensures that member account administrators cannot modify or disable AWS CloudTrail.

Key Concept

Multi-account governance using AWS Organizations and AWS IAM Identity Center federation.
Estimated Time:1m 30s
Rate this question

Topics

Multi-Account Management and Governance

More questions from this topic