Examkin

Question

Difficulty: MediumMulti-Account Management and Governance

A software-as-a-service (SaaS) provider is structuring a new multi-account AWS environment using AWS Organizations. The security team wants to establish centralized governance and security controls. Specifically, they must integrate their external enterprise identity provider (IdP) for centralized single sign-on and administrative access across all accounts. They also need to enforce security policies that prevent member accounts from altering AWS CloudTrail configurations or deleting critical Amazon S3 audit log buckets. Which combination of actions should a solutions architect recommend to satisfy these requirements? (Select TWO.)

  1. Enable AWS IAM Identity Center and configure federation with the external identity provider to manage single sign-on user access across all accounts.Answer
  2. Create a Service Control Policy (SCP) in AWS Organizations that denies cloudtrail:StopLogging and s3:DeleteBucket actions, and apply it to the organizational units (OUs) containing member accounts.Answer
  3. C
    Manually provision individual IAM users with long-term security credentials in each member account for users coming from the external identity provider.
  4. D
    Perform daily administration and logging tasks using the AWS account root user of the organization's management account to ensure full administrative override.
  5. E
    Store the external identity provider's integration credentials and client secrets as plaintext String parameters in AWS Systems Manager Parameter Store for easy script retrieval.

Answer

The solutions architect should recommend enabling AWS IAM Identity Center and configuring federation with the external identity provider, while deploying a Service Control Policy (SCP) in AWS Organizations to deny cloudtrail:StopLogging and s3:DeleteBucket actions at the organizational unit (OU) level.
Centralizing governance requires combining identity management and preventative guardrails. The combination of AWS IAM Identity Center and Service Control Policies (SCPs) fulfills these goals. AWS IAM Identity Center integrates with external IdPs for single sign-on access without creating individual IAM users. SCPs in AWS Organizations restrict member accounts from modifying CloudTrail settings or deleting log buckets, enforcing strict compliance policies.

Step-by-Step Solution

1
Address the centralized identity and single sign-on requirement.
By enabling AWS IAM Identity Center and setting up federation with the external enterprise IdP, the organization can map enterprise directory groups to AWS permissions centrally, avoiding local IAM users.
This establishes a centralized, secure identity mechanism with temporary credentials across the entire Organization.
2
Implement policy guardrails to protect auditing and log storage in member accounts.
Create a Service Control Policy (SCP) that explicitly denies cloudtrail:StopLogging and s3:DeleteBucket and attach it to the member account OUs.
SCPs restrict the maximum permissions of all users in member accounts, including the root user, ensuring that localized administrative access cannot bypass centralized logging and auditing controls.

Key Concept

Centralized multi-account governance using AWS Organizations, Service Control Policies (SCPs), and AWS IAM Identity Center federation.
Estimated Time:2m 0s
Rate this question

Topics

Multi-Account Management and Governance

More questions from this topic