A Solutions Architect is designing a secure multi-account environment using AWS Organizations. The company needs to centrally manage single sign-on access for all employees across the accounts. Additionally, the security team must enforce compliance policies to prevent member accounts from disabling logging. Which combination of AWS services or features should the Solutions Architect implement to meet these requirements? (Select TWO.)
- AWS IAM Identity Center to configure centralized single sign-on access.Answer
- SCPs in AWS Organizations to prevent member accounts from disabling logging.Answer
- CIndividual IAM users created in each member account with active access keys for employee login.
- DAWS account root user credentials of the management account to perform standard administration tasks.
- ESCPs applied to the root of the Organization to restrict the actions of the management account root user.
Answer
AWS IAM Identity Center to configure centralized single sign-on access, and SCPs in AWS Organizations to prevent member accounts from disabling logging.
Centralizing access is best achieved via AWS IAM Identity Center, while enforcing cross-account configuration constraints is the primary function of SCPs applied via AWS Organizations.
Step-by-Step Solution
Key Concept
AWS multi-account governance using AWS IAM Identity Center for centralized access and SCPs in AWS Organizations for compliance enforcement.