Examkin

Question

Difficulty: MediumMulti-Account Management and Governance

A company is using AWS Organizations to manage a multi-account environment. The security team wants to implement a centralized identity management solution that allows corporate employees to authenticate using their existing external Identity Provider (IdP) credentials and access resources across multiple AWS accounts. Additionally, the security team needs to prevent individual member accounts from disabling AWS CloudTrail logging. Which solution meets these requirements with the least operational overhead?

  1. A
    Use the AWS Organizations management account root user credentials to establish a direct SAML 2.0 federation with the external IdP. Apply a Service Control Policy (SCP) to the management account itself to deny cloudtrail:StopLogging and cloudtrail:DeleteTrail actions.
  2. B
    Create individual IAM users in each member account and configure AWS IAM Identity Center to map external IdP users to these IAM users. Write a custom AWS Lambda function that triggers on AWS CloudTrail configuration changes in member accounts to automatically re-enable logging.
  3. Configure AWS IAM Identity Center to federate with the external IdP. Assign permission sets to users and groups for AWS Organizations member accounts. Apply a Service Control Policy (SCP) at the root level of the organization that denies the cloudtrail:StopLogging and cloudtrail:DeleteTrail actions on all member Organizational Units (OUs).Answer
  4. D
    Create individual IAM users in the management account with long-term credentials for each external IdP user, and configure cross-account roles in member accounts. Use resource-based policies on the AWS CloudTrail Amazon S3 buckets in member accounts to restrict administrative access.

Answer

Configure AWS IAM Identity Center to federate with the external Identity Provider (IdP), assign permission sets to users and groups for AWS Organizations member accounts, and apply a Service Control Policy (SCP) at the root level of the organization to deny cloudtrail:StopLogging and cloudtrail:DeleteTrail actions on all member Organizational Units (OUs).
The correct solution uses AWS IAM Identity Center to establish federation with the external Identity Provider, enabling centralized authentication without creating individual IAM users. By applying a Service Control Policy at the Organization root level, the policy is inherited by all member accounts and organizational units, preventing administrators in member accounts from stopping or deleting AWS CloudTrail.

Step-by-Step Solution

1
Configure AWS IAM Identity Center to federate with the external Identity Provider (IdP).
Establishes a single sign-on (SSO) gateway allowing enterprise users to access AWS accounts using their existing corporate credentials without local IAM user provisioning.
Reduces operational overhead and centralizes identity management by delegating authentication to the external IdP.
2
Create permission sets and assign them to users and groups across the organization accounts.
Users and groups receive permissions defined by the permission sets in specific AWS accounts.
Allows fine-grained access control across multiple accounts in AWS Organizations.
3
Create and attach a Service Control Policy (SCP) to the organization's root or member OUs that denies CloudTrail deletion and stop logging actions.
Ensures all member accounts inherit the policy, prohibiting users (including account administrators) from stopping or deleting trails.
Enforces governance and compliance controls uniformly across all member accounts in a multi-account organization.

Key Concept

Centralized federation and organization-wide governance policies using AWS IAM Identity Center and Service Control Policies (SCPs).
Estimated Time:2m 0s
Rate this question

Topics

Multi-Account Management and Governance

More questions from this topic