Examkin

Question

Difficulty: MediumMulti-Account Management and Governance

A Solutions Architect is designing a multi-account governance strategy for a media company that manages its workloads using AWS Organizations. The company's security policy requires that all administrative access to member accounts in the Production OU must be federated using the corporate identity provider. Additionally, member account administrators must be prevented from creating local IAM users or generating long-term IAM access keys. Which combination of actions should the Solutions Architect recommend to meet these requirements?

  1. Enable AWS IAM Identity Center in the management account and link it to the corporate identity provider. Configure administrative permission sets, and apply an SCP to the Production OU that denies the iam:CreateUser and iam:CreateAccessKey actions.Answer
  2. B
    Create individual IAM users in each member account with administrative policies attached, configure a SAML 2.0 identity provider in each account, and have corporate users federate directly to their corresponding local IAM user credentials.
  3. C
    Require administrators to use the root user credentials of each member account to perform administrative tasks, and write an SCP at the root level of the organization to deny standard IAM user creation across the OU.
  4. D
    Configure Active Directory Connector in each member account to sync corporate identities, and write a script to automatically provision local IAM users with access keys for each synchronized user in the member accounts.

Answer

Enable AWS IAM Identity Center in the management account and link it to the corporate identity provider, configure administrative permission sets, and apply an SCP to the Production OU that denies the iam:CreateUser and iam:CreateAccessKey actions.
Enabling AWS IAM Identity Center and linking it to the corporate identity provider centralizes federated identity management across all member accounts in the organization. Combining this with an SCP applied to the Production OU that denies the iam:CreateUser and iam:CreateAccessKey actions enforces compliance by preventing administrators from creating local users or using long-term credentials.

Step-by-Step Solution

1
Centralize identity federation
Enable AWS IAM Identity Center in the management account of AWS Organizations and integrate it with the corporate identity provider (IdP).
This allows centralized login and access control without having to manage credentials or users locally in member accounts.
2
Configure permissions centrally
Create administrative permission sets in AWS IAM Identity Center and assign them to the appropriate corporate identity provider groups/users for the member accounts.
This grants the necessary administrative permissions in member accounts via short-term security credentials instead of long-term keys.
3
Enforce credentials and user restrictions
Create and attach an SCP to the Production OU that denies the iam:CreateUser and iam:CreateAccessKey actions.
This policy ensures that even administrators within the member accounts cannot create local users or long-term credentials, enforcing the compliance rule.

Key Concept

Centralized federation with AWS IAM Identity Center and governance enforcement via Service Control Policies (SCPs) in AWS Organizations
Rate this question

Topics

Multi-Account Management and Governance

More questions from this topic