Examkin

Question

Difficulty: MediumMulti-Account Management and Governance

As a solutions architect, you are tasked with securing a gaming studio's environment within AWS Organizations. The security team wants to enforce a policy where no member accounts can disable GuardDuty, while ensuring the management account retains administrative control and is not restricted by this policy. Additionally, the studio wants to manage employee permissions centrally from an external identity provider without creating static credentials. Which combination of actions will meet these governance requirements with the least operational overhead?

  1. Set up IAM Identity Center integrated with the external identity provider. Create an SCP that denies GuardDuty disabling actions and attach it to the organization's root.Answer
  2. B
    Provision unique IAM users in each member account and configure access keys for external identity provider integration. Create an SCP that denies GuardDuty disabling actions and attach it to the organization's root.
  3. C
    Set up IAM Identity Center integrated with the external identity provider. Create an SCP that denies GuardDuty disabling actions and attach it to the organization's root. Mandate the use of the management account's root user credentials for daily administrative tasks.
  4. D
    Provision unique IAM users in a centralized hub VPC and establish trust relationships with member accounts, syncing passwords with the external identity provider. Create an SCP that denies GuardDuty disabling actions and attach it to the organization's root.

Answer

Set up IAM Identity Center integrated with the external identity provider, and create an SCP that denies GuardDuty disabling actions and attach it to the organization's root.
Integrating IAM Identity Center with an external identity provider enables native identity federation, satisfying the requirement to avoid static credentials. Creating an SCP that denies GuardDuty disabling actions and attaching it to the root of the organization enforces the security requirement on all member accounts. Because SCPs do not restrict permissions in the management account, administrative control is preserved without impacting the management account itself.

Step-by-Step Solution

1
Integrate the external identity provider with IAM Identity Center to enable centralized federation without static access credentials.
Centralized, federated identity management is established across all AWS accounts.
This satisfies the requirement to manage employee permissions centrally from an external provider without using static access keys or credentials.
2
Create an SCP denying GuardDuty disablement actions (such as guardduty:DeleteDetector) and apply it at the organization's root.
All member accounts are restricted from disabling GuardDuty, while the management account remains unrestricted.
SCPs apply to all member accounts within an organization but do not apply to the management account itself, meeting both security and administrative requirements.

Key Concept

Centralized identity federation and multi-account policy governance using SCPs
Rate this question

Topics

Multi-Account Management and Governance

More questions from this topic