Examkin

Question

Difficulty: MediumMulti-Account Management and Governance

A financial services firm is implementing a multi-account governance strategy using AWS Organizations. The security department requires that no users or roles within any member account, including local administrators, can delete Amazon RDS automated or manual database snapshots. Furthermore, the firm wants to enable employees to access AWS resources using their existing corporate credentials, ensuring that no long-term IAM user credentials are created in individual member accounts. Which strategy should the solutions architect recommend to satisfy these requirements?

  1. Enable AWS IAM Identity Center and integrate it with the corporate identity provider for federated access. Create a Service Control Policy (SCP) that denies the rds:DeleteDBSnapshot and rds:DeleteDBClusterSnapshot actions, and attach the SCP to the organization root or the Organizational Units containing the member accounts.Answer
  2. B
    Create individual IAM users with long-term credentials in each member account for every corporate user. Write an IAM policy that denies RDS snapshot deletion and attach it to each IAM user to prevent unauthorized modifications.
  3. C
    Enable AWS IAM Identity Center and integrate it with the corporate identity provider. Create a Service Control Policy (SCP) that denies the rds:DeleteDBSnapshot and rds:DeleteDBClusterSnapshot actions, and attach it to the organization's management account to enforce restrictions on all administrative actions in both the management and member accounts.
  4. D
    Configure the organization's management account root user credentials to perform all daily administrative tasks in member accounts. Create an IAM policy denying the deletion of RDS snapshots and apply it directly to the management account's root user credentials.

Answer

Enable AWS IAM Identity Center integrated with the corporate identity provider, and apply a Service Control Policy (SCP) denying the database snapshot deletion actions to the organization root or organizational units.
The correct strategy combines AWS IAM Identity Center with a Service Control Policy (SCP) applied at the organization level. AWS IAM Identity Center enables seamless identity federation with the corporate directory, removing the need for local IAM users and long-term access keys. Applying an SCP that denies the database snapshot deletion actions to the organization root or OUs establishes a mandatory security guardrail that cannot be bypassed by any user or role in the member accounts, including local administrators.

Step-by-Step Solution

1
Configure identity federation using AWS IAM Identity Center connected to the corporate identity provider.
Users can log in using corporate credentials without creating individual IAM users with long-term security keys in member accounts.
This meets the requirement of centralized single sign-on and adheres to the security principle of not distributing long-term credentials.
2
Write a Service Control Policy (SCP) with an explicit Deny statement for rds:DeleteDBSnapshot and rds:DeleteDBClusterSnapshot.
A policy document is created that blocks any delete operations on RDS database snapshots.
Explicit denies in SCPs act as guardrails that override any local administrator permissions.
3
Attach the SCP to the organization root or specific OUs containing the member accounts.
The restriction is enforced across all member accounts within the scope of the organization root or OUs.
This ensures the security guardrail is inherited by all target member accounts, preventing snapshot deletion by any user or role.

Key Concept

Centralized multi-account governance using AWS IAM Identity Center for identity federation and Service Control Policies (SCPs) for policy enforcement.
Rate this question

Topics

Multi-Account Management and Governance

More questions from this topic