Examkin

Question

Difficulty: Very hardMulti-Account Management and Governance

A global financial services enterprise uses AWS Organizations to manage its multi-account environment. The security team needs to implement governance controls with the following requirements:
- Security audit teams require read-only access across all member accounts without managing local IAM credentials.
- No member account administrator can disable CloudTrail or delete the S3 buckets containing audit logs.
- Developers in sandbox accounts must have administrative privileges but must be prevented from launching GPU-based instance types (such as `p*` or `g*`) or creating resources outside of approved regions (`us-east-1` and `us-west-2`).
- Day-to-day administration of the AWS Organization must be delegated to administrators using temporary credentials, preventing the use of the management account's root credentials for routine tasks.

Which combination of actions should the Solutions Architect take to meet these requirements? (Select TWO.)

  1. Configure AWS IAM Identity Center integrated with the enterprise identity provider (IdP). Create a read-only permission set and assign it to the security audit team's group across the organization. Create administrative permission sets for day-to-day organization management in the management account.Answer
  2. Attach a Service Control Policy (SCP) at the organization root that denies log deletion and CloudTrail modification API calls. Attach a separate SCP to the Sandbox Organizational Unit (OU) that denies the `ec2:RunInstances` action for non-approved regions and GPU instance types.Answer
  3. C
    Create individual IAM users in each member account for the security auditors, generating access keys and secret keys. Set up an IAM policy on the management account root user that denies organization modifications to prevent routine root user access.
  4. D
    Create a Service Control Policy (SCP) and attach it directly to the management account to restrict its root user from performing routine administration. Implement a custom IAM policy in the management account to block GPU instances and replicate it to all member accounts.
  5. E
    Attach an SCP to the Sandbox OU that allows GPU instances only in approved regions. For the audit access, configure a cross-account IAM role in each member account that trusts individual IAM user credentials created specifically for the audit team in the management account.

Answer

The correct strategy combines configuring AWS IAM Identity Center integrated with the enterprise identity provider to govern administrative and audit access, along with deploying Service Control Policies (SCPs) at the organization root and organizational unit levels to enforce log protection and developer resource constraints.
The correct solution uses AWS IAM Identity Center to federate user access, allowing administrative and audit teams to log in using temporary credentials, which complies with the mandate to avoid root credentials. The application of SCPs at the organization root secures CloudTrail and S3 logs against member account admin modifications, and applying another SCP to the Sandbox OU isolates resource constraints to the developer environments.

Step-by-Step Solution

1
Address the centralized access and root credential requirements by setting up AWS IAM Identity Center.
Federation is established with the enterprise identity provider, mapping the audit group to a read-only permission set and the admin group to administrative permission sets. This avoids local credentials and management account root user usage.
AWS IAM Identity Center provides centralized access management with temporary credentials, adhering to compliance and least-privilege mandates.
2
Address the log protection requirement by writing a Service Control Policy (SCP) that restricts S3 bucket deletion and CloudTrail modifications.
An SCP containing deny actions for S3 and CloudTrail is applied at the root of the AWS Organization.
SCPs apply to all member accounts in the organization, preventing even local administrators from disabling logs or deleting audit trails.
3
Address the sandbox constraints by writing an SCP that restricts regions and instance types.
An SCP is attached directly to the Sandbox Organizational Unit (OU), preventing developers from running unauthorized instance types or operating in unauthorized regions.
Applying the SCP at the OU level ensures sandbox constraints do not affect production workloads or core security operations.

Key Concept

Centralized multi-account governance using AWS Organizations SCPs for policy guardrails combined with AWS IAM Identity Center for federated identity control.
Estimated Time:3m 0s
Rate this question

Topics

Multi-Account Management and Governance

More questions from this topic