Examkin

Question

Difficulty: HardMulti-Account Governance and Organizational Structure

A logistics corporation is migrating its legacy workloads to a multi-account environment managed by AWS Organizations. The new structure consists of three organizational units (OUs): Core-Services, Workloads-Dev, and Workloads-Prod. The security team mandates the following governance controls:

* Developers in Workloads-Dev must be prohibited from deploying internet-facing Application Load Balancers (ALBs) or provisioning internet gateways, while retaining permissions to deploy private workloads.
* No entity, including the administrative role within member accounts, in Workloads-Prod may delete or modify Amazon GuardDuty configurations, AWS Security Hub settings, or AWS CloudTrail trails.
* AWS CloudTrail logs from all accounts must be aggregated into a central Amazon S3 bucket within a dedicated Log-Archive account, encrypted using a KMS key.

Which two actions should the solutions architect take to implement these controls?

  1. Attach a Service Control Policy (SCP) to the Workloads-Dev OU that denies ec2:CreateInternetGateway and ec2:AttachInternetGateway, and denies elasticloadbalancing:CreateLoadBalancer if the elasticloadbalancing:Scheme condition key is not equal to internal. Attach a separate SCP to the Workloads-Prod OU that denies guardduty:DeleteDetector, securityhub:DisableSecurityHub, and cloudtrail:DeleteTrail actions.Answer
  2. In the Log-Archive account, create a customer managed KMS key. Configure the key policy to grant the AWS CloudTrail service principal permission to use the key for encrypting logs, and allow cross-account access. Configure the central S3 bucket policy to allow the CloudTrail service principal from the organization to write objects, and reference this KMS key in the CloudTrail configuration for all member accounts.Answer
  3. C
    Create an IAM permissions boundary and apply it to all developer roles in the Workloads-Dev accounts to prevent the creation of public load balancers and internet gateways. For the Workloads-Prod accounts, create an IAM policy that denies security service deletion and attach it directly to the local administrator roles in each member account.
  4. D
    In the Log-Archive account, configure the central S3 bucket to use default encryption with the AWS-managed S3 key (aws/s3). Update the bucket policy to allow the AWS Organizations ID as a principal, ensuring that CloudTrail in all member accounts can write to the bucket and use the default managed key for encryption.
  5. E
    Use AWS Resource Access Manager (RAM) to share the central S3 bucket in the Log-Archive account with all accounts in the organization. Configure CloudTrail in each member account to write to the local RAM resource share, ensuring secure transit and automated compliance reporting.

Answer

Attach Service Control Policies (SCPs) to the Workloads-Dev and Workloads-Prod OUs to enforce resource restrictions and guardrails. Configure a central S3 bucket in the Log-Archive account and encrypt it using a Customer Managed KMS key configured for cross-account access.
Applying Service Control Policies (SCPs) to the target OUs ensures that the restrictions on public load balancers, internet gateways, and security configurations are enforced for all users, including administrators and the root user. To allow CloudTrail in other accounts to write logs to a centralized S3 bucket, a Customer Managed KMS key in the Log-Archive account must be used since AWS-managed keys do not allow cross-account permissions configuration.

Step-by-Step Solution

1
Use AWS Organizations to partition accounts into dedicated OUs (Workloads-Dev, Workloads-Prod, and Core-Services) to enable target-specific policy inheritance.
Establishes a logical organizational structure where governance policies can be applied at scale.
Allows group-level control over accounts rather than configuring governance policies individually per account.
2
Create and attach an SCP to the Workloads-Dev OU that denies ec2:CreateInternetGateway and ec2:AttachInternetGateway, and conditionally denies elasticloadbalancing:CreateLoadBalancer when elasticloadbalancing:Scheme is not internal.
Prevents developers in the Dev accounts from exposing workloads to the public internet.
SCPs act as guardrails that apply to all roles, including administrators and the root user, ensuring compliance rules cannot be bypassed.
3
Create and attach an SCP to the Workloads-Prod OU that denies delete/disable API operations on GuardDuty, Security Hub, and CloudTrail.
Secures production auditing and threat detection configurations from unauthorized tampering.
Ensures that even compromised administrator roles in production accounts cannot shut down auditing and detection services.
4
Create a Customer Managed Key (CMK) in the Log-Archive account, update its key policy to allow cross-account access, and set up an S3 bucket with a policy allowing CloudTrail writes.
Enables multi-account log aggregation with centralized encryption controls.
AWS-managed keys (aws/s3) cannot be shared across accounts because their key policies are locked and cannot be modified.

Key Concept

Applying OUs, Service Control Policies, and Customer Managed KMS Keys to implement multi-account governance and central logging.
Rate this question

Topics

Multi-Account Governance and Organizational Structure

More questions from this topic