Examkin

Question

Difficulty: MediumMulti-Account Management and Governance

A logistics company is setting up a multi-account structure on AWS using AWS Organizations. The company wants to implement a centralized identity management solution to allow employees to access multiple AWS accounts using their existing corporate Active Directory credentials. Additionally, the security team needs to ensure that no member accounts can disable AWS CloudTrail.

Which two actions should a solutions architect take to meet these requirements? (Select two.)

  1. Configure AWS IAM Identity Center to federate with the corporate Active Directory to manage user access across all AWS accounts.Answer
  2. Create a Service Control Policy (SCP) that denies permissions to disable or delete CloudTrail, and attach it to the organizational units containing the member accounts.Answer
  3. C
    Create individual IAM users with long-term credentials in each member account mapping to each corporate Active Directory user.
  4. D
    Write a restrictive IAM policy that denies the disabling of CloudTrail and attach it directly to the root user of each member account.
  5. E
    Create IAM roles with administrative privileges in the management account and share the root credentials of the management account with Active Directory administrators.

Answer

Configure AWS IAM Identity Center to federate with the corporate Active Directory, and create a Service Control Policy (SCP) that denies permissions to disable or delete CloudTrail attached to the organizational units containing the member accounts.
Centralizing identity federation using AWS IAM Identity Center allows users to authenticate once using their Active Directory credentials and access their assigned roles across AWS accounts securely. Utilizing Service Control Policies (SCPs) at the Organizational Unit (OU) level provides a governance guardrail that prevents any entity, including administrators and the root user in member accounts, from stopping or deleting CloudTrail logging.

Step-by-Step Solution

1
Address the centralized identity requirement by integrating the identity provider.
AWS IAM Identity Center is configured to federate with the corporate Active Directory, allowing centralized SSO across accounts.
This eliminates the need to create local IAM users in individual accounts.
2
Address the governance requirement to prevent member accounts from disabling CloudTrail.
A Service Control Policy is created with a Deny effect on CloudTrail modification APIs and attached to the Organizational Units (OUs).
SCPs apply to all users and roles within member accounts (including root users), enforcing the restriction centrally.

Key Concept

AWS multi-account governance using AWS Organizations, Service Control Policies, and centralized federation with AWS IAM Identity Center.
Rate this question

Topics

Multi-Account Management and Governance

More questions from this topic