Examkin

Question

Difficulty: MediumMulti-Account Governance and Organizational Structure

A global e-commerce corporation manages its multi-account environment using AWS Organizations. The accounts are organized into several Organizational Units (OUs), including a Production workloads OU. Local administrators in these workload accounts possess full administrative rights via the AdministratorAccess IAM policy. To maintain strict regulatory compliance, the central security team must ensure that no user or role, including the root user, within the Production workloads OU can disable Amazon GuardDuty or AWS Security Hub. This security guardrail must apply immediately to all existing workload accounts and be automatically enforced on any new accounts added to the OU. Which solution should a Solutions Architect implement to meet these requirements with the least operational overhead?

  1. Attach a Service Control Policy (SCP) to the Production workloads OU that denies GuardDuty and Security Hub disabling and modification actions, while allowing local administrators to continue using their existing IAM policies.Answer
  2. B
    Configure an IAM permission boundary in each workload account that denies GuardDuty and Security Hub modification actions, and mandate that all local administrator roles must have this boundary attached.
  3. C
    Deploy an AWS Config rule across all workload accounts to detect unauthorized modifications to GuardDuty and Security Hub, and configure an AWS Systems Manager Automation document to automatically re-enable the services.
  4. D
    Attach a Service Control Policy (SCP) to the Production workloads OU that explicitly allows all administrative actions except for GuardDuty and Security Hub operations, and remove the local IAM AdministratorAccess policy from the workload accounts.

Answer

Attach a Service Control Policy (SCP) to the Production workloads OU that denies GuardDuty and Security Hub disabling and modification actions, while allowing local administrators to continue using their existing IAM policies.
The correct solution uses a Service Control Policy (SCP) attached to the workloads Organizational Unit (OU). SCPs act as guardrails that define the maximum available permissions for accounts within an OU. They apply to all users and roles, including the root user, and are automatically inherited by any new accounts added to the OU. Because local administrators retain the local AdministratorAccess IAM policy, they can perform all other administrative tasks, while the SCP prevents them from disabling or modifying the security services. This provides a preventive control with the least operational overhead.

Step-by-Step Solution

1
Identify the organizational boundary and governance requirement.
The requirement is to prevent disabling GuardDuty and Security Hub across all accounts in the Production workloads OU, including future accounts, without restricting other admin actions.
This narrows down the solution to preventive guardrails at the AWS Organizations level rather than account-level configurations.
2
Evaluate AWS Organizations Service Control Policies (SCPs) vs local IAM controls.
An SCP attached to the OU is inherited by all accounts under it, applying to all users including the root user. Since it filters permissions, it prevents the actions even if local IAM policies allow them.
SCPs provide the necessary preventive guardrail with minimal operational overhead and apply automatically to new accounts.
3
Assess the operational impact on local administrator permissions.
By maintaining the local AdministratorAccess policy, local admins retain full privileges on other services, while the SCP blocks the specified forbidden actions.
This meets the operational requirement of keeping administrative rights for daily tasks without central intervention.

Key Concept

Service Control Policies (SCPs) as Permission Guardrails
Rate this question

Topics

Multi-Account Governance and Organizational Structure

More questions from this topic