Examkin

Question

Difficulty: MediumIdentity and Access Management (IAM)

A company is designing a secure environment for its development teams across multiple AWS accounts managed under AWS Organizations. The security team wants to enforce two specific requirements:

1. Developers must be prevented from deleting any Amazon S3 buckets.
2. Developers must be allowed to create and manage IAM roles for their applications, but they must not be able to escalate their own permissions or assign administrator permissions to the new roles.

Which combination of mechanisms should a solutions architect recommend to satisfy these requirements? (Select TWO.)

  1. Apply a Service Control Policy (SCP) at the Organizational Unit (OU) level that explicitly denies the s3:DeleteBucket action.Answer
  2. Use IAM permissions boundaries to define the maximum permissions that developers can assign to the roles they create.Answer
  3. C
    Use the AWS account root user credentials to directly configure bucket policies on each S3 bucket to explicitly deny the s3:DeleteBucket action.
  4. D
    Create individual IAM users with long-term access keys for each developer and configure IAM Identity Center to map their enterprise directory identities to these users.
  5. E
    Enable AWS Key Management Service (AWS KMS) automatic key rotation to automatically update the S3 bucket policies and revoke delete permissions after each rotation cycle.

Answer

Apply a Service Control Policy (SCP) at the Organizational Unit (OU) level that explicitly denies the s3:DeleteBucket action, and use IAM permissions boundaries to define the maximum permissions that developers can assign to the roles they create.
Applying an SCP at the OU level to explicitly deny the s3:DeleteBucket action provides a strong security guardrail that prevents any user or role in the member accounts from deleting buckets. Using IAM permissions boundaries allows the security team to delegate role creation to developers while ensuring that the permissions of the newly created roles cannot exceed the boundaries defined by the security team.

Step-by-Step Solution

1
Evaluate how to prevent S3 bucket deletion across multiple accounts under AWS Organizations.
An SCP is the most effective way to enforce coarse-grained policy controls across member accounts, overriding local administrators.
SCPs apply to all users and roles in member accounts, ensuring global compliance.
2
Determine how to delegate role creation without allowing privilege escalation.
Applying an IAM permissions boundary ensures that any role created or managed by the developers cannot exceed the boundary's permissions.
This prevents developers from creating administrative roles to bypass their own constraints.

Key Concept

Permissions Boundaries and Service Control Policies (SCPs) are used together to delegate administrative permissions safely and enforce guardrails in multi-account environments.
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic