Examkin

Question

Difficulty: MediumMulti-Account Governance and Organizational Structure

An enterprise uses AWS Organizations to manage its multi-account environment. The security team wants to establish guardrails that apply to all member accounts, including the local account administrators. Specifically, they must prevent any member account from leaving the AWS Organization, and prevent the deletion or modification of a centralized security audit IAM role named CentralSecOpsRole in any member account. Which two configurations should the Solutions Architect implement to meet these requirements? (Select two.)

  1. Apply a Service Control Policy (SCP) to the organization root that denies the organizations:LeaveOrganization action.Answer
  2. Apply an SCP to the organizational units containing the member accounts that denies configuration changes and deletion of the CentralSecOpsRole.Answer
  3. C
    Apply an IAM permission boundary to all users and roles in the member accounts that explicitly denies organizations:LeaveOrganization and modification of CentralSecOpsRole.
  4. D
    Attach an SCP to the organization root that explicitly allows the CentralSecOpsRole to perform all actions and denies all other roles from modifying it.
  5. E
    Configure a resource-based policy on the IAM role CentralSecOpsRole in each member account that denies access to all principals except the security team's cross-account role.

Answer

The correct configurations are to apply a Service Control Policy (SCP) to the organization root that denies the organizations:LeaveOrganization action, and apply an SCP to the organizational units containing the member accounts that denies configuration changes and deletion of the CentralSecOpsRole.
Applying a Service Control Policy (SCP) at the organization root that denies the organizations:LeaveOrganization action effectively prevents any principal in a member account from removing the account from the organization. Additionally, applying an SCP to the organizational units (OUs) that denies IAM actions (such as update and delete actions) on the resource path of CentralSecOpsRole ensures that even local administrators cannot modify or delete the role, as SCPs override local administrator permissions.

Step-by-Step Solution

1
Determine the proper tool for enforcing guardrails that override local administrators.
Service Control Policies (SCPs) are identified as the only mechanism that can restrict actions for all principals in a member account, including the root user and administrators.
SCPs define the maximum available permissions for member accounts in an AWS Organization, allowing global restrictions that local users cannot bypass.
2
Select the correct action to prevent accounts from leaving the organization.
Identify the organizations:LeaveOrganization API action and restrict it at the root of the AWS Organization.
Applying this restriction at the root ensures it applies transitively to all accounts in the organization.
3
Formulate a policy to protect the CentralSecOpsRole from modification.
Target the specific role ARN using an SCP that denies write actions (such as delete, update, and policy attachment) on the CentralSecOpsRole.
Denying these write actions on the specific resource prevents any administrator in the member accounts from tampering with the security auditing role.

Key Concept

Service Control Policies (SCPs) act as permission boundaries for AWS Organizations and are required to restrict actions for local administrators in member accounts.
Estimated Time:2m 0s
Rate this question

Topics

Multi-Account Governance and Organizational Structure

More questions from this topic