Examkin

Question

Difficulty: HardMulti-Account Management and Governance

A Solutions Architect is designing a secure multi-account environment using AWS Organizations. The environment consists of a management account and multiple member accounts grouped into operational Organizational Units (OUs). The security team has established two key governance mandates: first, users from the corporate external Active Directory must have single sign-on access to member accounts based on their job roles without using persistent IAM credentials; second, all member accounts must be prevented from stopping AWS CloudTrail logging or deleting trails. Which combination of actions should the Solutions Architect take to satisfy these mandates? (Select TWO.)

  1. Configure AWS IAM Identity Center, integrate it with the external Active Directory, and assign permission sets to corporate groups mapped to the target accounts.Answer
  2. Create an SCP that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail actions, and attach it to the root of the Organization or to the parent OUs of the member accounts.Answer
  3. C
    Create individual IAM users in each member account, configure long-term credentials for federated users, and map them to corporate Active Directory identities.
  4. D
    Apply an SCP directly to the management account to restrict its root user from modifying Organization-wide CloudTrail configurations.
  5. E
    Store the corporate Active Directory connection credentials as plaintext parameters in Systems Manager Parameter Store to automate role assumption across member accounts.

Answer

The correct combination of actions is to configure AWS IAM Identity Center integrated with the external Active Directory to assign permission sets to corporate groups, and to create an SCP denying the stopping or deleting of CloudTrail logs attached to the root of the Organization or parent OUs.
Configuring AWS IAM Identity Center integrated with the external Active Directory provides a centralized federation mechanism that avoids persistent IAM credentials. Attaching an SCP with explicit deny statements for cloudtrail:StopLogging and cloudtrail:DeleteTrail to the root or parent OUs ensures that all member accounts conform to the security guardrail, while the management account remains unaffected as SCPs do not restrict it.

Step-by-Step Solution

1
Address the centralized identity and access mandate by establishing federation.
AWS IAM Identity Center is configured and connected to the corporate Active Directory.
This allows group-based mapping and grants temporary security credentials for single sign-on access without managing persistent credentials.
2
Address the governance requirement to prevent disabling or deleting CloudTrail logs across member accounts.
An SCP with explicit deny rules for cloudtrail:StopLogging and cloudtrail:DeleteTrail is drafted.
SCPs are the standard mechanism to enforce guardrails across member accounts in AWS Organizations.
3
Attach the SCP to the appropriate boundary within the Organization hierarchy.
The SCP is attached to the Organization root or parent OUs, exempting the management account.
SCPs do not restrict the management account, which satisfies the operational separation of the management account while enforcing strict policies on all member accounts.

Key Concept

Centralized multi-account governance and secure identity federation using AWS Organizations SCPs and AWS IAM Identity Center.
Estimated Time:2m 30s
Rate this question

Topics

Multi-Account Management and Governance

More questions from this topic