Examkin

Question

Difficulty: MediumMulti-Account Management and Governance

A retail company is building a multi-account structure on AWS using AWS Organizations. The security team wants to mandate that all administrative and developer access across member accounts must go through AWS IAM Identity Center, which is integrated with their external identity provider. To enforce this, the team wants to prevent the creation of local IAM users and long-term access keys within all member accounts. The management account must remain exempt from this policy to allow break-glass access. Which solution should a solutions architect recommend to meet these requirements with the least administrative effort?

  1. A
    Create a custom IAM policy in each member account that denies the creation of IAM users and access keys, and assign this policy to the root user of each member account to prevent any local administrator from creating new credentials.
  2. Configure AWS IAM Identity Center to handle federation. Create a Service Control Policy (SCP) that denies iam:CreateUser and iam:CreateAccessKey actions. Attach this SCP to the root of the organization.Answer
  3. C
    Create individual IAM users with long-term security credentials in each member account, and configure a script that syncs these users with the external identity provider. Apply an IAM policy to these users that denies the creation of further IAM resources.
  4. D
    Enable federation using AWS IAM Identity Center. Create a Service Control Policy (SCP) that denies the iam:CreateUser and iam:CreateAccessKey actions. Attach the SCP directly to the organization's management account and configure the root user of the management account to perform all daily administrative tasks.

Answer

Configure AWS IAM Identity Center to handle federation. Create a Service Control Policy (SCP) that denies iam:CreateUser and iam:CreateAccessKey actions. Attach this SCP to the root of the organization.
The correct solution uses AWS IAM Identity Center to enable centralized federation. By creating a Service Control Policy (SCP) that denies the creation of IAM users and access keys, and attaching it to the root of the organization, the rule is enforced on all member accounts. Because SCPs do not apply to the management account, the management account remains exempt from the policy, allowing break-glass root access in emergencies.

Step-by-Step Solution

1
Configure AWS IAM Identity Center
Enables centralized identity federation with the external identity provider for access to all AWS accounts.
Allows users to log in with their corporate credentials without creating individual IAM users in member accounts.
2
Create a Service Control Policy (SCP)
An SCP is defined that denies iam:CreateUser and iam:CreateAccessKey actions.
Ensures that member accounts cannot bypass the federated access mechanism by creating local users or access keys.
3
Attach the SCP to the root of the organization
The restriction applies to all member accounts, while the management account remains unaffected.
SCPs do not apply to the management account, which satisfies the requirement to keep it exempt for emergency break-glass access.

Key Concept

Centralized Governance using SCPs and IAM Identity Center
Rate this question

Topics

Multi-Account Management and Governance

More questions from this topic