Examkin

Question

Difficulty: HardMulti-Account Governance and Organizational Structure

A biotechnology firm uses AWS Organizations to manage its multi-account environment, which is structured into several Organizational Units (OUs), including Core-Security, Workloads-Prod, and Workloads-Dev. The solutions architect must establish governance controls to satisfy the following requirements:

1. Security logging (AWS CloudTrail) and compliance auditing (AWS Config) must remain enabled in all workload accounts, and member account administrators must be prevented from disabling or deleting these resources.
2. Developers in the Workloads-Dev OU must be restricted to launching only pre-approved configurations of Amazon EC2, Amazon RDS, and AWS Lambda resources to ensure compliance and cost control.

Which two actions should the solutions architect implement to meet these requirements?

  1. Attach a Service Control Policy (SCP) to the Workloads-Prod and Workloads-Dev OUs that denies cloudtrail:StopLogging, cloudtrail:UpdateTrail, cloudtrail:DeleteTrail, and config:DeleteConfigRule actions.Answer
  2. B
    Configure an organizational CloudTrail trail in the management account to write logs to an S3 bucket in the Core-Security account, encrypting the trail using the default AWS-managed KMS key (aws/cloudtrail) to automatically allow member accounts to write encrypted logs.
  3. Create AWS Service Catalog portfolios of approved EC2, RDS, and Lambda configurations in the management account, share them with the Workloads-Dev OU using AWS Service Catalog portfolio sharing, and attach an SCP to the Workloads-Dev OU that denies direct resource creation actions unless the request is made via servicecatalog.amazonaws.com using the aws:CalledVia condition.Answer
  4. D
    Create an IAM permissions boundary in each member account that permits only the creation of EC2, RDS, and Lambda resources, and assign local administrators the responsibility of attaching this boundary to all IAM users and roles, assuming this delegates enforcement without needing an SCP.
  5. E
    Create AWS Service Catalog portfolios containing the approved configurations in the management account, share the portfolios with the Workloads-Dev OU using AWS Resource Access Manager (RAM), and attach an SCP to the Workloads-Dev OU that allows only servicecatalog:* actions.

Answer

The correct options are attaching a Service Control Policy (SCP) to deny modification of logging/auditing resources, and sharing AWS Service Catalog portfolios with a CalledVia SCP constraint to restrict developer resource creation.
The correct approach combines Service Control Policies (SCPs) to prevent member account administrators from altering auditing baselines and AWS Service Catalog sharing combined with an SCP using the aws:CalledVia condition key to restrict resource creation. Applying an SCP that denies CloudTrail and Config modification prevents even root or administrator users in member accounts from tampering with compliance resources. Sharing Service Catalog portfolios and enforcing their use via the aws:CalledVia condition key ensures developers can only deploy approved configurations of EC2, RDS, and Lambda.

Step-by-Step Solution

1
Address the logging and auditing requirements by identifying the correct policy type that can restrict local administrators.
Apply a Service Control Policy (SCP) to the Workloads-Prod and Workloads-Dev OUs that explicitly denies actions like cloudtrail:StopLogging and config:DeleteConfigRule. This ensures local administrators cannot bypass these guardrails.
SCPs act as permission filters across accounts in an AWS Organization, overriding local administrative permissions.
2
Address the developer resource restriction requirement by defining approved configurations and enforcing their usage.
Share AWS Service Catalog portfolios containing the approved configurations from the management account to the Workloads-Dev OU, and use an SCP containing a Deny statement with the aws:CalledVia condition key to prevent direct creation outside Service Catalog.
This enforces compliance by blocking direct resource provisioning while allowing creation when mediated by the approved Service Catalog products.

Key Concept

Multi-account governance using Service Control Policies (SCPs) to establish organization-wide guardrails and AWS Service Catalog to enforce standardized resource provisioning.
Rate this question

Topics

Multi-Account Governance and Organizational Structure

More questions from this topic