Examkin

Question

Difficulty: Very hardMulti-Account Governance and Organizational Structure

An enterprise is establishing a multi-region landing zone using AWS Organizations and AWS Control Tower to govern a rapidly growing portfolio of application accounts. The solutions architect must establish a secure multi-account structure, centralize security operations, apply service control policies (SCPs), and configure automated account provisioning. In what sequence should the solutions architect perform these setup steps to establish the environment while maintaining operational security and ensuring all new accounts are compliant upon creation?

  1. 1Provision the landing zone from the organization's management account, establishing the foundational Security organizational unit (OU), Log Archive account, and Audit account.
  2. 2Enable AWS IAM Identity Center and configure administrative permission sets mapped to corporate identity provider groups for access to the management and core security accounts.
  3. 3Delegate administration for AWS Config, AWS Security Hub, and Amazon GuardDuty to the dedicated Audit account to centralize monitoring and auditing operations.
  4. 4Attach custom Service Control Policies (SCPs) to the organizational units to restrict allowed AWS Regions and prevent unauthorized modification of security resources.
  5. 5Configure AWS Control Tower Account Factory Customizer to automate the deployment of baseline network resources and security configurations during the provisioning of new workload accounts.

Answer

The correct sequence begins with provisioning the landing zone using AWS Control Tower, followed by enabling AWS IAM Identity Center for administrative access, delegating security administration to the Audit account, attaching custom Service Control Policies (SCPs) to organizational units, and finally configuring the Account Factory Customizer for automated account provisioning.
Establishing the AWS landing zone must follow a strict dependencies-first approach. First, the management account must initialize AWS Control Tower to spin up the Security OU along with the Log Archive and Audit accounts. Second, federated access via AWS IAM Identity Center is configured to secure cross-account administration. Third, security and compliance administration is delegated to the Audit account. Fourth, custom SCPs are attached to the OUs to define strict guardrails. Finally, the Account Factory Customizer is configured to automate compliant workload provisioning.

Step-by-Step Solution

1
Provision the landing zone via AWS Control Tower.
Creates the Log Archive account, Audit account, and Security OU.
Establishes the multi-account structure and core AWS accounts required by all subsequent setup steps.
2
Enable and configure AWS IAM Identity Center.
Establishes federated user access and administrative roles mapped to identity groups.
Allows secure administrative access to core security and member accounts without utilizing root credentials or local IAM users.
3
Delegate administration of security services to the Audit account.
Centralizes compliance monitoring, security findings, and AWS Config aggregation in the Audit account.
Adheres to the principle of least privilege by separating security monitoring duties from management account operations.
4
Author and attach Service Control Policies (SCPs) to parent OUs.
Applies top-down guardrails restricting AWS regions and preventing security service disabling.
Establishes a hardened governance boundary that applies automatically to existing and future member accounts.
5
Configure AWS Control Tower Account Factory Customizer.
Enables automated deployment of baseline networking (VPCs) and local configurations.
Ensures that newly provisioned workload accounts are compliant from day one by deploying them under established guardrails.

Key Concept

AWS multi-account governance setup lifecycle using AWS Control Tower, IAM Identity Center, delegated administration, Service Control Policies, and Account Factory automation.
Rate this question

Topics

Multi-Account Governance and Organizational Structure

More questions from this topic