Examkin

Question

Difficulty: MediumMulti-Account Governance and Organizational Structure

A financial services company is designing a multi-account environment using AWS Organizations to support a new product line. The solutions architect must implement a governance strategy that enforces two requirements. First, no user or role in the member accounts should be able to disable AWS Config or alter its configuration. Second, standard security baselines, including specific IAM roles and security groups, must be automatically provisioned in any new account that is added to the production Organizational Unit (OU). Which combination of actions will meet these requirements? (Select TWO.)

  1. Create a Service Control Policy (SCP) that denies `config:StopConfigurationRecorder`, `config:DeleteDeliveryChannel`, and `config:PutConfigurationRecorder` actions, and attach it to the production OU.Answer
  2. Create an AWS CloudFormation StackSet with service-managed permissions, enable automatic deployment, and target the production OU to provision the baseline resources.Answer
  3. C
    Create a Service Control Policy (SCP) with an Allow statement for the `config:*` actions restricted to a specific administrator role, and attach it to the production OU.
  4. D
    Configure AWS Resource Access Manager (RAM) to share the baseline IAM roles and security groups from a central security account to the production OU.
  5. E
    Configure a federated SAML 2.0 role in the management account that trust-policies member accounts, and run a scheduled script to assume this role in each member account.

Answer

To protect AWS Config, deploy a Service Control Policy (SCP) that denies modifications to the configuration recorder and delivery channel. To deploy the baseline resources automatically, use an AWS CloudFormation StackSet with service-managed permissions targeted at the production Organizational Unit (OU).
The correct solution combines a Service Control Policy (SCP) and AWS CloudFormation StackSets. The SCP uses an explicit Deny statement on AWS Config modification APIs to act as a guardrail, ensuring no local user or role can disable the service. CloudFormation StackSets with service-managed permissions and automatic deployment enabled automatically provision standard baseline resources, such as IAM roles and security groups, in any new account added to the target Organizational Unit (OU) without requiring manual setup.

Step-by-Step Solution

1
Identify the mechanism to prevent disabling or altering AWS Config across member accounts in AWS Organizations.
Determine that a Service Control Policy (SCP) with an explicit Deny statement for configuration modification actions is required.
SCPs act as organizational guardrails that override any local administrator permissions.
2
Identify the mechanism to automate the deployment of baseline resources (IAM roles and security groups) to new accounts in the production OU.
Determine that CloudFormation StackSets with service-managed permissions and automatic deployment enabled is the correct solution.
StackSets integrated with AWS Organizations can automatically deploy resources when new accounts are added to an OU.

Key Concept

Organizational guardrails and automated multi-account resource provisioning
Estimated Time:2m 0s
Rate this question

Topics

Multi-Account Governance and Organizational Structure

More questions from this topic