Examkin

Question

Difficulty: EasyMulti-Account Management and Governance

A Solutions Architect is designing the governance strategy for a company's multi-account environment managed by AWS Organizations. The company requires central control over user access using an external identity provider. Additionally, they must ensure that CloudTrail logging cannot be disabled in any member account. Which combination of actions should the Solutions Architect take to meet these requirements? (Select TWO.)

  1. Configure AWS IAM Identity Center to federate access with the company's external identity provider.Answer
  2. Create a Service Control Policy (SCP) that denies the cloudtrail:StopLogging action and attach it to the organization root.Answer
  3. C
    Create IAM users in each member account and share long-term credentials with users in the external directory.
  4. D
    Use the management account root credentials to configure daily security policies and perform user authorization.
  5. E
    Attach a Service Control Policy (SCP) to the management account to prevent its own administrator users from stopping CloudTrail logging.

Answer

Configure AWS IAM Identity Center to federate access with the company's external identity provider, and create a Service Control Policy (SCP) that denies the cloudtrail:StopLogging action and attach it to the organization root.
Centralized access control is best achieved by integrating AWS IAM Identity Center with the external identity provider. Enforcing organization-wide security boundaries (such as preventing the disabling of CloudTrail) is done via Service Control Policies (SCPs) attached to the organization's root or organizational units (OUs), which restrict actions in all member accounts.

Step-by-Step Solution

1
Set up centralized identity federation.
AWS IAM Identity Center is connected to the external identity provider, allowing users to log into member accounts without needing local credentials.
This simplifies governance and complies with single sign-on security standards.
2
Establish guardrails against disabling logging.
A Service Control Policy denying the cloudtrail:StopLogging action is created and attached to the root of the organization.
SCPs allow centralized restriction of actions across all member accounts in the organization, preventing users from altering vital security logging.

Key Concept

Centralized multi-account governance using AWS Organizations Service Control Policies (SCPs) and federated access with AWS IAM Identity Center.
Rate this question

Topics

Multi-Account Management and Governance

More questions from this topic