Examkin

Question

Difficulty: MediumMulti-Account Management and Governance

A financial services company is using AWS Organizations to manage its multi-account environment. The security team wants to ensure that no member accounts in the 'Core-Workloads' Organizational Unit (OU) can disable Amazon GuardDuty or delete its detectors. Additionally, the company needs to establish centralized access control so that employees can sign in using their existing corporate identity provider credentials and be mapped to specific roles across various AWS accounts. Which combination of actions will meet these requirements? (Select TWO.)

  1. Enable AWS IAM Identity Center in the organization's management account and configure federation with the corporate identity provider.Answer
  2. Create a Service Control Policy (SCP) that denies guardduty:DeleteDetector and guardduty:UpdateDetector, and attach the SCP to the Core-Workloads OU.Answer
  3. C
    Create individual IAM users with long-term security credentials in each member account for every corporate user, and write a custom script to synchronize their credentials.
  4. D
    Configure the administration team to use the AWS account root user credentials of the management account to perform federated single sign-on administration tasks.
  5. E
    Store the corporate identity provider's integration client secrets as plaintext parameters in Systems Manager Parameter Store in each member account.

Answer

Enable AWS IAM Identity Center in the organization's management account and configure federation with the corporate identity provider, and create a Service Control Policy (SCP) that denies guardduty:DeleteDetector and guardduty:UpdateDetector, and attach the SCP to the Core-Workloads OU.
Centralizing access control through AWS IAM Identity Center and federating it with the corporate identity provider simplifies administration and eliminates the need to manage individual IAM users in member accounts. Additionally, applying a Service Control Policy (SCP) to the OU containing member accounts enforces security policies globally, preventing local administrators from disabling Amazon GuardDuty.

Step-by-Step Solution

1
Evaluate the requirement to prevent member accounts from disabling Amazon GuardDuty.
Local IAM policies are insufficient because local administrators can modify or bypass them. A Service Control Policy (SCP) must be used at the Organizational Unit (OU) level to establish a permission guardrail.
SCPs apply to all users and roles in member accounts, including the root user, ensuring compliance with security baselines.
2
Evaluate the requirement for centralized federated access using the corporate identity provider.
AWS IAM Identity Center should be enabled in the management account and integrated with the identity provider via SAML 2.0 or OIDC.
This centralizes user management, eliminates local IAM users, and enforces single sign-on across the organization.
3
Combine the security baseline and federation solutions to form the complete architectural recommendation.
The final architecture uses IAM Identity Center for access governance and SCPs for resource governance.
This meets both the security and operations requirements according to AWS Well-Architected best practices.

Key Concept

Multi-Account Security Governance and Centralized Identity Management
Rate this question

Topics

Multi-Account Management and Governance

More questions from this topic