Examkin

Question

Difficulty: HardMulti-Account Governance and Organizational Structure

A healthcare software provider uses AWS Organizations to manage 150 member accounts. The security team mandates that a specific IAM role named SecurityAuditRole must exist in all accounts and must be protected from deletion or modification by any local administrator. However, developers in the Research and Development (R&D) Organizational Unit (OU) require full administrative access to create, update, and delete IAM roles for local microservices testing. Which strategy should the solutions architect implement to enforce this governance control with the least administrative overhead?

  1. Attach a Service Control Policy (SCP) to the R&D OU that denies IAM modification and deletion actions where the resource matches the ARN of the SecurityAuditRole, while continuing to grant developers administrative access via local IAM policies.Answer
  2. B
    Attach a Service Control Policy (SCP) to the R&D OU that explicitly allows all IAM actions except those targeting the SecurityAuditRole, and remove the local administrative IAM policies from the member accounts.
  3. C
    Configure an AWS KMS customer managed key (CMK) policy that denies key usage permissions to any IAM role modification API requests targeting the SecurityAuditRole across all member accounts.
  4. D
    Use AWS Resource Access Manager (RAM) to share a master IAM policy from the management account to the R&D OU member accounts, and attach this shared policy directly to the developer roles to explicitly deny modifications to the SecurityAuditRole.

Answer

Attach a Service Control Policy (SCP) to the R&D OU that denies IAM modification and deletion actions where the resource matches the ARN of the SecurityAuditRole, while continuing to grant developers administrative access via local IAM policies.
The correct strategy combines a Service Control Policy (SCP) with local IAM policies. The SCP acts as a guardrail by denying IAM delete and modification API actions specifically targeting the ARN of the SecurityAuditRole. Because explicit denies override any allows, this prevents local administrators from modifying the role. Since SCPs do not grant permissions directly, developers still need local IAM policies granting administrative permissions (such as iam:*) to manage other resources in their account.

Step-by-Step Solution

1
Analyze the requirement to restrict access to a specific resource (SecurityAuditRole) across multiple accounts while allowing administrative actions on other resources of the same type.
Identify that Service Control Policies (SCPs) are the primary mechanism in AWS Organizations to restrict permissions across member accounts.
SCPs allow defining organization-wide guardrails that apply to all users and roles in member accounts, including the root user.
2
Evaluate the interaction between SCPs and local IAM policies.
Determine that an explicit deny in an SCP overrides any local allow permissions. Developers can keep their administrative local IAM policies (allowing iam:*), but the SCP will intercept and block any actions targeting the SecurityAuditRole.
The intersection of the SCP (guardrail) and the local IAM policy (grant) determines the effective permissions.
3
Formulate the SCP rule targeting the ARN of the role: arn:aws:iam::*:role/SecurityAuditRole.
The SCP should deny actions such as iam:DeleteRole, iam:PutRolePolicy, iam:DeleteRolePolicy, iam:AttachRolePolicy, iam:DetachRolePolicy, and iam:UpdateAssumeRolePolicy on this specific resource.
This target matches the role across all accounts in the OU and prevents unauthorized modification.

Key Concept

Service Control Policies (SCPs) act as permission filters (guardrails) and must be combined with local IAM policies to grant permissions.
Estimated Time:2m 30s
Rate this question

Topics

Multi-Account Governance and Organizational Structure

More questions from this topic