Examkin

Question

Difficulty: MediumMulti-Account Management and Governance

An enterprise is migrating its multi-tier workloads to AWS and has established an organization in AWS Organizations. The enterprise has created separate OUs for development, testing, and production workloads. The security team mandates that employees must use their existing corporate IdP to access AWS resources. Additionally, the team requires that no administrator in any member account can disable or modify Amazon GuardDuty or AWS CloudTrail in their respective accounts. Which combination of actions should a solutions architect recommend to meet these requirements with the least operational overhead?

  1. Configure AWS IAM Identity Center to federate with the corporate IdP. Create an SCP at the organization root that denies permissions to delete or modify GuardDuty and CloudTrail resources, which automatically applies to all member accounts.Answer
  2. B
    Create individual IAM users in each member account for all employees and configure SAML 2.0 federation for each user. Apply local IAM policies in each account to deny permissions to modify GuardDuty and CloudTrail.
  3. C
    Require administrators to use the root user credentials of the organization's management account to centrally manage all member accounts. Store the root access keys in a central repository to run daily automated verification scripts.
  4. D
    Configure AWS IAM Identity Center for user federation. Store the sensitive API keys and configurations of GuardDuty and CloudTrail as plaintext parameters in AWS Systems Manager Parameter Store using standard String parameters to simplify cross-account validation.

Answer

Configure AWS IAM Identity Center to federate with the corporate IdP, and apply an SCP at the organization root to deny permissions to delete or modify GuardDuty and CloudTrail resources.
The correct option addresses the requirements by configuring AWS IAM Identity Center to federate with the corporate IdP, which provides single sign-on access across all member accounts without the overhead of individual IAM users. It then applies an SCP at the organization root, which prevents administrators in member accounts from deleting or modifying GuardDuty and CloudTrail configurations, ensuring governance compliance.

Step-by-Step Solution

1
Address the centralized access requirement by setting up federation using AWS IAM Identity Center linked to the corporate IdP.
Users can authenticate via the corporate IdP and access their designated AWS accounts and resources using single sign-on (SSO) without managing individual IAM user credentials in each account.
This meets the security team's requirement for centralized corporate identity integration while minimizing operational overhead.
2
Address the guardrail requirement by creating an SCP in AWS Organizations.
The SCP is defined to deny actions like guardduty:DeleteDetector, guardduty:UpdateDetector, cloudtrail:StopLogging, and cloudtrail:DeleteTrail.
SCPs act as permission boundaries that apply to all users and roles in member accounts, including the root user of those accounts.
3
Attach the SCP to the organization root or target OUs.
The restriction is enforced globally across all member accounts under those OUs, preventing administrators from bypassing or disabling these security services.
Centralized enforcement at the OU or organization root level ensures consistent governance and compliance.

Key Concept

Centralized multi-account governance using AWS Organizations Service Control Policies (SCPs) combined with AWS IAM Identity Center for federated identity management.
Rate this question

Topics

Multi-Account Management and Governance

More questions from this topic