Examkin

Question

Difficulty: HardMulti-Account Governance and Organizational Structure

A financial services company is implementing a multi-account strategy using AWS Organizations. The organization contains three main Organizational Units (OUs): CoreServicesOU, SecurityOU, and WorkloadsOU. The WorkloadsOU has two child OUs: ProductionOU and DevelopmentOU.

The security team has the following requirements:
1. No IAM user or role within any member account in the WorkloadsOU should be able to delete or modify the configurations of an IAM role named SecurityComplianceRole.
2. Developers in the DevelopmentOU must be allowed to deploy and test new AWS services freely, but they must be restricted from launching Amazon EC2 instances of any type other than the t3 or m5 families.
3. The administration of resources within the SecurityOU must not be impacted by these policies.

Which combination of Service Control Policies (SCPs) and OU attachments will meet these requirements with the least operational overhead?

  1. Attach a Service Control Policy (SCP) to the WorkloadsOU that denies iam:DeleteRole, iam:DeleteRolePolicy, and iam:DetachRolePolicy actions on the SecurityComplianceRole resource. Attach another SCP to the DevelopmentOU that denies ec2:RunInstances if the ec2:InstanceType is not like t3.* or m5.*. Keep the default FullAWSAccess SCP attached at all levels.Answer
  2. B
    Attach a Service Control Policy (SCP) to the organization root that denies iam:DeleteRole, iam:DeleteRolePolicy, and iam:DetachRolePolicy actions on the SecurityComplianceRole resource. Remove the FullAWSAccess SCP from the DevelopmentOU and attach an SCP that explicitly allows ec2:RunInstances for t3.* and m5.* instance types.
  3. C
    Configure an IAM permissions boundary in each member account that denies modifications to the SecurityComplianceRole and restricts ec2:RunInstances to t3.* and m5.* instance types. Apply this permissions boundary automatically to all federated roles by configuring it at the AWS Organizations root level.
  4. D
    Attach a Service Control Policy (SCP) to the WorkloadsOU that denies iam:DeleteRole, iam:DeleteRolePolicy, and iam:DetachRolePolicy on the SecurityComplianceRole unless the caller is utilizing an AWS-managed KMS key. Remove the FullAWSAccess SCP from the organization root to enforce default-deny behavior for all non-approved services.

Answer

Attach a Service Control Policy (SCP) to the WorkloadsOU that denies iam:DeleteRole, iam:DeleteRolePolicy, and iam:DetachRolePolicy actions on the SecurityComplianceRole resource. Attach another SCP to the DevelopmentOU that denies ec2:RunInstances if the ec2:InstanceType is not like t3.* or m5.*. Keep the default FullAWSAccess SCP attached at all levels.
The correct solution attaches the role protection policy to the WorkloadsOU, ensuring the restriction inherits to both Production and Development OUs without affecting the SecurityOU. The EC2 restriction is attached to the DevelopmentOU to target only developers. The default FullAWSAccess policy is kept at all levels to prevent blocking other services that developers need to test.

Step-by-Step Solution

1
Analyze the scope of the IAM role protection requirement.
The restriction must apply to all member accounts in the WorkloadsOU (Production and Development) but must not affect the SecurityOU or CoreServicesOU.
Attaching the role-protection SCP to the WorkloadsOU target ensures that both child OUs (ProductionOU and DevelopmentOU) inherit the restriction without impacting other top-level OUs.
2
Analyze the EC2 instance type constraint.
The constraint must only restrict the DevelopmentOU, allowing other OUs (like ProductionOU) to use other instance types, and must not prevent developers from using other services.
Attaching a deny policy to the DevelopmentOU that blocks ec2:RunInstances unless the instance type matches the approved families ensures only the target environment is restricted. Keeping FullAWSAccess ensures developers can still use other services.
3
Evaluate explicit deny behavior in SCPs.
An explicit deny in an SCP overrides any allow permissions granted by IAM policies within the accounts.
This guarantees that local administrators cannot override the restriction, satisfying the governance requirement.

Key Concept

AWS Organizations Service Control Policies (SCPs) act as permission guards that inherit down the OU hierarchy, where explicit denies override any allows without granting permissions directly.
Rate this question

Topics

Multi-Account Governance and Organizational Structure

More questions from this topic