Examkin

Question

Difficulty: HardMulti-Account Management and Governance

A Solutions Architect is designing a multi-account strategy using AWS Organizations. The organization consists of a management account, a Security organizational unit (OU), a Production OU, and a Development OU. The security team requires that no users or roles in the Production and Development OUs are allowed to disable AWS CloudTrail or delete trails. However, the Security OU must retain the ability to modify CloudTrail settings for automated maintenance. Additionally, the company wants to implement centralized single sign-on access using their existing external identity provider (IdP) without managing individual credentials in each member account.

Which combination of actions will meet these security and access requirements?

  1. A
    Create individual IAM users with long-term credentials in the management account for all corporate users. Set up cross-account IAM roles in the member OUs that trust the management account. Attach a Service Control Policy (SCP) that denies CloudTrail deletion actions to the organization's root.
  2. B
    Enable AWS IAM Identity Center in the management account and configure federation with the external IdP. Create a Service Control Policy (SCP) that denies the cloudtrail:StopLogging and cloudtrail:DeleteTrail actions. Attach this SCP to the management account itself to restrict its administrative and root users from modifying organizational trails.
  3. Enable AWS IAM Identity Center in the management account and configure federation with the external IdP. Create a Service Control Policy (SCP) that denies the cloudtrail:StopLogging and cloudtrail:DeleteTrail actions, and attach this SCP to the Production and Development OUs.Answer
  4. D
    Enable AWS IAM Identity Center in the management account. Create a Service Control Policy (SCP) that denies the cloudtrail:StopLogging and cloudtrail:DeleteTrail actions, and attach this SCP to the organization's root. For member account access, create individual IAM users with administrative permissions in each member account and configure federated API access.

Answer

Enable AWS IAM Identity Center in the management account, configure federation with the external IdP, create an SCP that denies the cloudtrail:StopLogging and cloudtrail:DeleteTrail actions, and attach this SCP to the Production and Development OUs.
The correct option addresses all requirements by using AWS IAM Identity Center to federate identity access from the external identity provider, which avoids managing local IAM users. It correctly limits the scope of the SCP by attaching it only to the Production and Development OUs, thereby exempting the Security OU and allowing it to perform authorized maintenance tasks.

Step-by-Step Solution

1
Address the centralized authentication requirement.
Enable AWS IAM Identity Center in the organization's management account and configure integration with the external identity provider.
This establishes centralized single sign-on and federated access, eliminating the need to create and manage individual IAM users with long-term credentials in each member account.
2
Define the policy to prevent unauthorized CloudTrail modifications.
Create a Service Control Policy (SCP) containing a Deny rule for the cloudtrail:StopLogging and cloudtrail:DeleteTrail actions.
SCPs act as permission guardrails that define the maximum permissions for member accounts under an organization.
3
Target the policy attachment to respect organizational unit boundaries.
Attach the created SCP to the Production and Development OUs, leaving the Security OU and the management account root exempt from the policy.
Attaching the SCP to specific OUs allows granular enforcement, ensuring the Security OU retains its administrative capability over CloudTrail while protecting the target environments.

Key Concept

Fine-grained governance using Service Control Policies and centralized authentication with AWS IAM Identity Center.
Estimated Time:2m 30s
Rate this question

Topics

Multi-Account Management and Governance

More questions from this topic