Examkin

Question

Difficulty: HardMulti-Account Management and Governance

A media streaming company is organizing its cloud footprint using AWS Organizations. To enforce compliance, the security team must restrict specific activities within member accounts without affecting the management account. The environment consists of a Production OU and a Sandbox OU. The compliance rules are:

1. Production accounts must not be able to disable AWS Security Hub or modify resource-tagging policies.
2. Sandbox accounts must be prohibited from launching EC2 instances that are not of the 't3' or 'm5' instance families.

Which combination of actions should a Solutions Architect implement to meet these governance requirements? (Select TWO.)

  1. Attach a Service Control Policy (SCP) to the Production OU that denies Security Hub configuration modifications and tag-policy changes.Answer
  2. Attach a Service Control Policy (SCP) to the Sandbox OU that denies the ec2:RunInstances action unless the ec2:InstanceType condition key matches t3.* or m5.*.Answer
  3. C
    Attach the compliance SCPs directly to the Organization Root to ensure they inherit down to the management account and all member OUs.
  4. D
    Create individual IAM users in each member account for developers and administrators, and configure IAM inline policies to restrict these actions.
  5. E
    Configure the root credentials of the management account to run a daily scheduled script that terminates non-compliant EC2 instances and recreates deleted tag policies in all member accounts.

Answer

Attach a Service Control Policy (SCP) to the Production OU that denies Security Hub configuration modifications and tag-policy changes, and attach a Service Control Policy (SCP) to the Sandbox OU that denies the ec2:RunInstances action unless the ec2:InstanceType condition key matches t3.* or m5.*.
The correct strategy combines target-specific Service Control Policies (SCPs) attached directly to the respective Organizational Units (OUs). Attaching a policy to prevent disabling Security Hub and modifying tag policies directly to the Production OU ensures that compliance is enforced only for production resources. Similarly, attaching an SCP restricting instance types to the Sandbox OU ensures developers have freedom to experiment within cost-effective boundaries. In both cases, the policies do not affect the management account, which satisfies the requirement to exclude it from the restrictions.

Step-by-Step Solution

1
Analyze the scope of the governance requirements for the Production OU and the Sandbox OU.
Identified that the Production OU requires restriction of Security Hub and tag policy modifications, while the Sandbox OU requires restricting EC2 instance types to t3 and m5 families. The management account must remain unaffected.
To design the correct AWS Organizations structure and policy placement without causing unintended policy inheritance across OUs.
2
Select the appropriate mechanism to enforce governance across member accounts centrally.
Determined that Service Control Policies (SCPs) are the native tool in AWS Organizations to restrict actions at the member account level, and they do not apply to the management account.
SCPs act as guardrails that define the maximum permissions for member accounts without affecting the management account's administrative access.
3
Formulate the SCPs and attach them to their target Organizational Units.
Created one SCP targeting Security Hub and tagging controls, attaching it to the Production OU. Created a second SCP targeting EC2 instance type restrictions using the ec2:InstanceType condition key, attaching it to the Sandbox OU.
Attaching the policies directly to the specific OUs applies the rules target-selectively, preventing policies from bleeding over to unintended OUs (e.g. preventing sandbox restrictions from affecting production).

Key Concept

AWS Organizations Service Control Policies (SCPs) and Organizational Unit (OU) policy inheritance.
Rate this question

Topics

Multi-Account Management and Governance

More questions from this topic