Examkin

Question

Difficulty: MediumMulti-Account Management and Governance

A retail company has migrated its business units into separate AWS accounts controlled by AWS Organizations. The compliance department demands that all developer access be federated from the company's external Active Directory, granting role-based access without long-term credentials. Furthermore, the company must guarantee that no administrator in any member account can delete or stop AWS CloudTrail logging. Which combination of AWS configurations will satisfy these requirements?

  1. Configure AWS IAM Identity Center to federate with the external Active Directory, define permission sets for developer roles, and apply Service Control Policies (SCPs) at the organizational unit (OU) level to deny the CloudTrail:StopLogging and CloudTrail:DeleteTrail actions.Answer
  2. B
    Create individual IAM users with long-term security keys in each member account, mapping each user to the Active Directory groups via an AWS Lambda synchronization function, and apply IAM policies in each member account that deny CloudTrail modifications.
  3. C
    Deploy AWS Directory Service for Microsoft Active Directory to manage identities. Instruct account administrators to perform all security tasks using the AWS account root credentials, and implement Service Control Policies (SCPs) applied directly to the management account root to prevent any modifications to CloudTrail.
  4. D
    Configure SAML federation using IAM roles in each member account, requiring developers to use individual IAM access keys to assume those roles. Apply IAM policies to the IAM roles in each member account that deny permission to stop CloudTrail.

Answer

Configure AWS IAM Identity Center to federate with the external Active Directory, define permission sets for developer roles, and apply Service Control Policies (SCPs) at the organizational unit (OU) level to deny the CloudTrail:StopLogging and CloudTrail:DeleteTrail actions.
The correct option correctly suggests integrating the external Active Directory with AWS IAM Identity Center to provide federated role-based access using temporary credentials. To enforce governance and prevent administrators in member accounts from stopping CloudTrail logging, Service Control Policies (SCPs) applied at the OU level must be used, as they act as a maximum permission boundary that cannot be bypassed by administrators in member accounts.

Step-by-Step Solution

1
Configure AWS IAM Identity Center integration with the external Active Directory to allow users to authenticate and receive temporary security credentials.
Developers can sign in to their respective AWS accounts using their existing Active Directory credentials without needing long-term IAM access keys.
This establishes federated access and complies with identity governance requirements.
2
Define permission sets in AWS IAM Identity Center to manage role-based access controls across accounts.
Developers are mapped to the correct IAM roles within member accounts based on Active Directory group membership.
This enforces least privilege access control across multiple AWS accounts.
3
Create and attach a Service Control Policy (SCP) to the relevant Organizational Units (OUs) that denies permissions for disabling or deleting CloudTrail logs.
Even users with administrator permissions in member accounts are blocked from stopping or deleting CloudTrail trails.
SCPs define the maximum permission boundaries for member accounts, overriding local administrator actions.

Key Concept

Multi-account identity federation and centralized governance using Service Control Policies (SCPs)
Rate this question

Topics

Multi-Account Management and Governance

More questions from this topic