Examkin

Question

Difficulty: HardMulti-Account Governance and Organizational Structure

A media conglomerate has configured an AWS Organizations structure consisting of a Security Organizational Unit (OU) and a Workloads OU. The Security OU contains a dedicated Security Operations account. A Solutions Architect must design a governance framework for AWS Config across the entire organization to satisfy the following requirements:
1. AWS Config must be active in all current and future accounts under the Workloads OU.
2. A set of mandatory compliance rules must be deployed centrally. Local administrators in member accounts must not be able to modify or delete these compliance rules.
3. Local administrators in the Workloads OU must retain the ability to deploy and manage application-specific, custom AWS Config rules.
4. No user or IAM role in the Workloads OU must be allowed to disable the configuration recorder or delete the configuration delivery channel.

Which solution should the Solutions Architect implement to meet these requirements with the least operational overhead?

  1. Register the Security Operations account as a delegated administrator for AWS Config. Deploy organization config rules from the Security Operations account. Attach a Service Control Policy (SCP) to the Workloads OU that denies the config:StopConfigurationRecorder and config:DeleteDeliveryChannel actions.Answer
  2. B
    Attach a Service Control Policy (SCP) to the Workloads OU that denies all config:* actions unless the caller is the AWS Organizations management account, then deploy both the mandatory rules and custom rules from the management account.
  3. C
    Register the Security Operations account as a delegated administrator for AWS Config. Deploy organization config rules from the Security Operations account. Configure member accounts to deliver Config data to a central S3 bucket encrypted using the default AWS-managed KMS key (aws/s3).
  4. D
    Deploy AWS Config rules using AWS CloudFormation StackSets from the management account. Deliver configuration history to a central S3 bucket in the Security Operations account, with a bucket policy that grants write access only to the AWS Organizations management account principal.

Answer

Register the Security Operations account as a delegated administrator for AWS Config. Deploy organization config rules from the Security Operations account. Attach a Service Control Policy (SCP) to the Workloads OU that denies the config:StopConfigurationRecorder and config:DeleteDeliveryChannel actions.
Registering the Security Operations account as a delegated administrator for AWS Config enables the central deployment of organization config rules. These rules are automatically created in all member accounts and cannot be modified or deleted by local administrators. To protect the underlying infrastructure of AWS Config, a Service Control Policy (SCP) is attached to the Workloads OU to deny the 'StopConfigurationRecorder' and 'DeleteDeliveryChannel' actions. This ensures the configuration recorder remains active, while still permitting local administrators to create and manage their own local custom rules because the SCP does not restrict 'PutConfigRule' or 'DeleteConfigRule' actions.

Step-by-Step Solution

1
Enable delegated administration for AWS Config to separate management duties from the Organization management account.
The Security Operations account gains the ability to manage AWS Config rules organization-wide.
This establishes central governance with least operational overhead without utilizing the root organization account.
2
Deploy organization-wide AWS Config rules using the delegated administrator account.
Mandatory rules are automatically created in all member accounts.
Organization config rules cannot be modified or deleted by users in member accounts, ensuring compliance.
3
Attach a Service Control Policy (SCP) to the Workloads OU targeting configuration recorder and delivery channel management.
Users in member accounts are blocked from stopping the recorder or deleting the delivery channel, while still being able to execute other config operations.
This protects the integrity of AWS Config recording while allowing local administrators to continue creating their own custom local rules.

Key Concept

AWS Organizations delegated administration and Service Control Policies (SCPs) for multi-account governance
Estimated Time:3m 0s
Rate this question

Topics

Multi-Account Governance and Organizational Structure

More questions from this topic