Examkin

Question

Difficulty: HardMulti-Account Governance and Organizational Structure

An insurance provider is designing a multi-account landing zone using AWS Organizations. The security team has established two strict compliance requirements for the new structure:
1. All Amazon S3 buckets created in member accounts must be encrypted using a specific customer managed key (CMK) hosted in a central Security account.
2. AWS Config compliance rules must be managed and deployed centrally across all member accounts from a dedicated Compliance account, without utilizing the Organizations management account for operational tasks.

Which TWO solutions should the solutions architect implement to meet these requirements?

  1. In the central Security account, create a Customer Managed Key (CMK) and configure its key policy to allow encryption and decryption actions for the AWS Organization's principal. In AWS Organizations, apply a Service Control Policy (SCP) to the member accounts' organizational units (OUs) that denies s3:PutBucketEncryption if the encryption algorithm is not aws:kms or if the KMS key ARN does not match the CMK in the Security account.Answer
  2. B
    In the Organizations management account, configure the AWS-managed KMS key for Amazon S3 (aws/s3) with a cross-account key policy that allows all member accounts to perform KMS actions. Apply an SCP at the root of the organization that denies the s3:CreateBucket action unless the default S3 encryption is configured to use this AWS-managed key.
  3. Enable trusted access for AWS Config in the AWS Organizations management account. Register the Compliance account as a delegated administrator for AWS Config, and deploy organizational conformance packs from the Compliance account to distribute the compliance rules to all member accounts.Answer
  4. D
    Attach a Service Control Policy (SCP) to the root of the organization that explicitly grants the Compliance account's administrative IAM roles permission to deploy and modify AWS Config conformance packs across all member accounts, overriding local IAM policy restrictions.
  5. E
    Use AWS Resource Access Manager (RAM) to share the AWS Config rules from the Compliance account with external organizational units. In the management account, apply an SCP that requires all member accounts to accept the shared resources and apply them locally.

Answer

Configure a Customer Managed Key (CMK) in the Security account with a key policy allowing organization-wide access, and use an SCP to deny S3 bucket encryption configurations that do not use this key. Additionally, register the Compliance account as a delegated administrator for AWS Config and deploy organizational conformance packs.
The correct solution involves creating a Customer Managed Key (CMK) in the Security account and granting cross-account permissions via its key policy, while applying an SCP to enforce its use for S3 bucket encryption. It also involves enabling trusted access for AWS Config and registering the Compliance account as a delegated administrator to deploy organizational conformance packs centrally.

Step-by-Step Solution

1
Set up cross-account S3 encryption enforcement.
A Customer Managed Key (CMK) is created in the Security account with a key policy that grants permissions to the organization's member accounts. An SCP is attached to the OUs to prevent S3 bucket creation/updates unless they reference this specific key ARN.
AWS-managed keys (like aws/s3) cannot be shared across accounts, meaning a Customer Managed Key is required. The key policy must explicitly allow cross-account access, and the SCP restricts member account actions to only use this key.
2
Establish delegated administration for compliance monitoring.
Trusted access for AWS Config is enabled in the Organizations management account, and the Compliance account is registered as a delegated administrator.
This adheres to the principle of least privilege by avoiding the use of the Organizations management account for operational tasks while permitting the Compliance account to manage organization-wide Config resources.
3
Deploy AWS Config rules organization-wide.
Organizational conformance packs are created and deployed from the Compliance account to all member accounts in the organization.
Organizational conformance packs automatically deploy the defined Config rules and remediation actions across all current and future accounts under the organization.

Key Concept

Multi-Account Governance using Service Control Policies and Delegated Administration
Rate this question

Topics

Multi-Account Governance and Organizational Structure

More questions from this topic