Examkin

Question

Difficulty: MediumMulti-Account Governance and Organizational Structure

An enterprise manages its multi-account cloud environment using AWS Organizations. The security team mandates that no IAM users or roles within the 'Workloads' Organizational Unit (OU) should be able to delete Amazon S3 buckets, with the sole exception of a specific break-glass IAM role named 'EmergencyAdmin' that exists in all member accounts. The security team wants to enforce this governance control centrally with the least operational overhead. Which solution should a Solutions Architect recommend?

  1. A
    Apply a Service Control Policy (SCP) to the Workloads OU that denies the `s3:DeleteBucket` action. In each member account, attach an IAM policy to all roles except `EmergencyAdmin` that explicitly denies the `s3:DeleteBucket` action.
  2. Apply a Service Control Policy (SCP) to the Workloads OU that denies the `s3:DeleteBucket` action. Include a condition in the SCP using `StringNotLike` for `aws:PrincipalARN` that excludes the `EmergencyAdmin` role ARN path `arn:aws:iam::*:role/EmergencyAdmin`.Answer
  3. C
    Apply a Service Control Policy (SCP) to the Workloads OU that denies the `s3:DeleteBucket` action. Use the `NotPrincipal` element within the SCP statement to exclude the `EmergencyAdmin` role from the deny effect.
  4. D
    Create a new OU named 'Diagnostics' for accounts that require emergency access. Apply the S3 deletion restriction SCP only to the Workloads OU, and manage S3 deletion permissions via local IAM policies within the Diagnostics OU.

Answer

Apply a Service Control Policy (SCP) to the Workloads OU that denies the `s3:DeleteBucket` action, using a condition with `StringNotLike` for `aws:PrincipalARN` to exclude the `EmergencyAdmin` role path.
The correct answer utilizes a Service Control Policy (SCP) applied to the target OU. By using an explicit Deny with a condition checking that the request's `aws:PrincipalARN` does not match the emergency role path, the policy allows the emergency role to bypass the restriction while denying S3 bucket deletion to all other users and roles centrally.

Step-by-Step Solution

1
Identify the target control requirement
Central restriction of `s3:DeleteBucket` for all principals in the 'Workloads' OU, except for a specific role named `EmergencyAdmin`.
This establishes the scope of the rule and the exception that must be configured.
2
Determine the capabilities of Service Control Policies (SCPs)
SCPs apply to all roles and users in member accounts, including root, but do not support the `NotPrincipal` element.
This rules out solutions that attempt to use `NotPrincipal` in the policy structure.
3
Formulate a policy condition for the exception
Use a `Deny` effect with a condition block containing `StringNotLike` or `ArnNotEquals` evaluating `aws:PrincipalARN` against the role pattern.
This ensures the explicit deny applies to all principals except the designated role ARN across all accounts in the OU.

Key Concept

AWS Organizations Service Control Policies (SCPs) act as guardrails. While they do not support the `NotPrincipal` element, they can implement exceptions using conditions matching the `aws:PrincipalARN` context key.
Estimated Time:2m 0s
Rate this question

Topics

Multi-Account Governance and Organizational Structure

More questions from this topic