Examkin

Question

Difficulty: MediumMulti-Account Governance and Organizational Structure

A digital media corporation is using AWS Organizations to manage multiple member accounts grouped under separate Organizational Units (OUs) for Development, Testing, and Production. The security team has deployed a centralized auditing tool that relies on an IAM role named 'AuditCollectorRole' present in all member accounts. The Solutions Architect must implement a governance strategy to prevent local administrators in member accounts from deleting or modifying this specific IAM role, without restricting their ability to manage other IAM resources. Which of the following governance strategies should the solutions architect implement to meet these requirements with the least administrative overhead?

  1. Attach a Service Control Policy (SCP) to the organization root that denies the 'iam:DeleteRole', 'iam:UpdateAssumeRolePolicy', and 'iam:PutRolePolicy' actions on the resource 'arn:aws:iam::*:role/AuditCollectorRole'.Answer
  2. B
    Define an IAM permission boundary in the management account, and use AWS Resource Access Manager (RAM) to share this permission boundary with all member accounts, requiring local administrators to attach it to their roles.
  3. C
    Deploy a Customer Managed Key (KMS CMK) in the security account, and configure all member accounts to require KMS decryption permissions for modifying the policy document of the AuditCollectorRole.
  4. D
    Create a Service Control Policy (SCP) that grants read-only IAM access to member accounts, assuming that the SCP automatically overrides local IAM policies to protect the AuditCollectorRole while allowing other IAM actions.

Answer

The correct strategy is to attach a Service Control Policy (SCP) to the organization root that denies specific IAM modification and deletion actions targeting the audit role resource path across all accounts.
Attaching a Service Control Policy (SCP) at the root of the organization allows the security team to enforce a guardrail across all member accounts. The deny policy targeting 'arn:aws:iam::*:role/AuditCollectorRole' prevents anyone, including local root users or administrators, from deleting or modifying the audit role, while still allowing them to manage all other IAM resources.

Step-by-Step Solution

1
Identify the governance tool capable of enforcing global boundaries across an AWS Organization.
Determine that Service Control Policies (SCPs) are the appropriate mechanism for multi-account governance.
SCPs define the maximum permissions for member accounts and cannot be overridden by local administrators.
2
Draft the policy statement targeting the specific IAM role.
Create an SCP statement with a Deny effect on actions 'iam:DeleteRole', 'iam:UpdateAssumeRolePolicy', and 'iam:PutRolePolicy' targeting the resource 'arn:aws:iam::*:role/AuditCollectorRole'.
This explicitly prevents deletion and policy modifications on the target role across all accounts while permitting actions on other role paths.
3
Attach the SCP at the appropriate level in the organization structure.
Attach the SCP to the organization root or to the parent OUs.
Applying the policy at the root or OU level ensures inheritance to all existing and future member accounts.

Key Concept

Using Service Control Policies (SCPs) as permission guardrails to restrict administrative actions on specific IAM resources across a multi-account organization.
Estimated Time:2m 0s
Rate this question

Topics

Multi-Account Governance and Organizational Structure

More questions from this topic