Examkin

Question

Difficulty: EasyMulti-Account Management and Governance

A software-as-a-service (SaaS) provider has multiple development and production environments, each hosted in a separate AWS account within an organization in AWS Organizations. The IT security team must establish a single location to manage user access and ensure that developers cannot configure long-term IAM user credentials. Which of the following actions should the Solutions Architect take to meet these requirements? (Select TWO.)

  1. Enable AWS IAM Identity Center and integrate it with the organization's existing external identity provider.Answer
  2. Apply a Service Control Policy (SCP) to the root of the organization that denies the creation of new IAM users and access keys.Answer
  3. C
    Use the AWS account root user credentials of each member account to perform daily administrative and access management tasks.
  4. D
    Manually create individual IAM users with administrative permissions in each member account for all engineering employees.
  5. E
    Save user access tokens and passwords as plaintext parameters in Systems Manager Parameter Store in the management account.

Answer

Enable AWS IAM Identity Center integrated with an external identity provider, and apply a Service Control Policy (SCP) to the root of the organization that denies the creation of new IAM users and access keys.
The correct approach involves centralizing user access management using AWS IAM Identity Center integrated with an external identity provider. To enforce compliance and prevent the creation of unauthorized long-term credentials, a Service Control Policy (SCP) must be applied to the organization's root to explicitly deny the creation of new IAM users and access keys across member accounts.

Step-by-Step Solution

1
Centralize user identity and credentials.
By enabling AWS IAM Identity Center and connecting it to an external identity provider, the organization eliminates the need to create local IAM users and long-term credentials.
This simplifies credential rotation and centralizes access control across all AWS accounts.
2
Enforce governance guardrails across the organization.
By attaching a Service Control Policy (SCP) to the root of the organization, the creation of IAM users and long-term access keys is blocked in all member accounts.
SCPs define the maximum permission boundary for member accounts, preventing administrators or developers from bypassing the centralized identity configuration.

Key Concept

Centralized identity management and organizational guardrails using AWS IAM Identity Center and Service Control Policies (SCPs).
Estimated Time:1m 0s
Rate this question

Topics

Multi-Account Management and Governance

More questions from this topic