Examkin

Question

Difficulty: MediumMulti-Account Governance and Organizational Structure

A smart energy utility provider is designing its AWS multi-account governance structure using AWS Organizations. The provider wants to automate the creation of new accounts for regional grid monitoring applications while enforcing strict guardrails. Specifically, they must prevent any member account from disabling AWS CloudTrail and ensure that a centralized security team can access all accounts using a pre-configured IAM role.

Which combination of actions should the Solutions Architect take to implement this governance model? (Select TWO.)

  1. Deploy an IAM role in each member account with a trust policy that allows the principal of the centralized security account to assume it, and attach appropriate administrative permissions.Answer
  2. Create a Service Control Policy (SCP) that denies the 'cloudtrail:StopLogging' and 'cloudtrail:DeleteTrail' actions, and attach it to the root of the AWS Organization or specific Organizational Units (OUs).Answer
  3. C
    Create a Service Control Policy (SCP) that grants the centralized security account administrative permissions, and attach it to the member accounts to allow direct management access.
  4. D
    Enable AWS CloudTrail log file encryption using the default AWS-managed KMS key (aws/cloudtrail), and modify its key policy to allow cross-account access for the security auditing tools.
  5. E
    Create a centralized Amazon S3 bucket in the security account with a bucket policy that allows write access solely to member account IAM identities using the 'aws:PrincipalOrgID' condition to secure the log uploads.

Answer

To implement this governance model, the Solutions Architect should deploy an IAM role in each member account with a trust policy that allows the principal of the centralized security account to assume it, and create a Service Control Policy (SCP) that denies the 'cloudtrail:StopLogging' and 'cloudtrail:DeleteTrail' actions, attaching it to the root or specific Organizational Units.
The correct solution involves deploying a cross-account IAM role in each member account that trusts the centralized security account, allowing secure administration, and applying an SCP to the root or OUs that explicitly denies disabling or deleting CloudTrail, which serves as a global guardrail.

Step-by-Step Solution

1
Analyze the requirement to prevent member accounts from disabling CloudTrail.
Identify that a Service Control Policy (SCP) with an explicit Deny rule is the correct mechanism because it establishes guardrails that even administrators in member accounts cannot bypass.
SCPs define the maximum permissions for member accounts in an organization.
2
Analyze the requirement for centralized security team access to member accounts.
Identify that cross-account IAM roles are required. Each member account needs a role that trusts the centralized security account's principal.
SCPs cannot grant permissions directly; access must be facilitated via IAM trust relationships.
3
Evaluate the distractors based on security and operational constraints.
Discard the options proposing AWS-managed KMS key modification, SCPs granting permissions directly, and log bucket policies that block the CloudTrail service principal.
AWS-managed KMS keys cannot have modified policies, SCPs only restrict rather than grant permissions, and CloudTrail requires service principal access to write logs.

Key Concept

AWS multi-account governance relies on SCPs for organization-wide guardrails and cross-account IAM roles for secure management access.
Rate this question

Topics

Multi-Account Governance and Organizational Structure

More questions from this topic