Examkin

Question

Difficulty: MediumMulti-Account Governance and Organizational Structure

An enterprise is establishing a multi-account structure in AWS Organizations. The Security team must enforce two governance requirements across all accounts in a newly created Organizational Unit (OU) named Workloads:

1. Prevent local administrators in member accounts from deleting or modifying a cross-account IAM role named SecurityAuditRole.
2. Allow applications in member accounts to encrypt data in their local Amazon S3 buckets using a centralized, customer-managed AWS KMS key hosted in a dedicated Security account. The key must only be usable for S3 encryption services.

Which combination of actions should a solutions architect take to meet these requirements? (Select TWO.)

  1. Attach a Service Control Policy (SCP) to the Workloads OU that denies the iam:DeleteRole, iam:PutRolePolicy, and iam:DeleteRolePolicy actions when the resource is the SecurityAuditRole.Answer
  2. In the Security account, create a KMS customer managed key and configure its key policy to grant the kms:GenerateDataKey and kms:Decrypt permissions to the member account root principals, using a condition that restricts the kms:ViaService to s3.amazonaws.com.Answer
  3. C
    Attach a Service Control Policy (SCP) to the Workloads OU that explicitly allows the member accounts to assume the SecurityAuditRole and denies all other roles from modifying it.
  4. D
    In the Security account, modify the key policy of the AWS-managed KMS key for Amazon S3 (aws/s3) to allow cross-account access from the member accounts in the Workloads OU.
  5. E
    Use AWS Resource Access Manager (RAM) to share the AWS-managed KMS key for Amazon S3 (aws/s3) from the Security account to the Workloads OU.

Answer

Attach a Service Control Policy (SCP) to the Workloads OU that denies modifying the SecurityAuditRole, and create a KMS customer managed key in the Security account with a key policy granting access to member accounts restricted via the kms:ViaService condition for S3.
Protecting a critical cross-account role is best achieved using a Service Control Policy (SCP) targeting the specific role name/ARN. For S3 cross-account encryption, a KMS customer managed key must be used since AWS-managed keys do not support policy modification or cross-account access. The key policy must allow the member accounts' principals to use the key, scoped down with a condition matching the S3 service principal.

Step-by-Step Solution

1
Address the role protection requirement by applying an SCP at the OU level.
Local administrative accounts in the member accounts are blocked from deleting or updating the SecurityAuditRole.
SCPs apply to all users and roles in member accounts, including the root user, making them the correct tool to enforce restriction guardrails.
2
Address the cross-account S3 encryption requirement by using a KMS customer managed key.
A key is created that allows configuration of a custom key policy for cross-account access.
AWS-managed keys cannot be shared across accounts, so a customer managed key is required.
3
Restrict the cross-account KMS key usage to S3 operations.
The key policy delegates access to member accounts under the condition that the service calling it is s3.amazonaws.com.
The kms:ViaService condition enforces that the key can only be used when requests originate from the specified AWS service (S3).

Key Concept

Centralized resource access control and policy guardrails using SCPs and KMS key policies in a multi-account AWS Organization.
Estimated Time:1m 30s
Rate this question

Topics

Multi-Account Governance and Organizational Structure

More questions from this topic