Examkin

Question

Difficulty: MediumMulti-Account Governance and Organizational Structure

A financial services company is designing a multi-account structure using AWS Organizations. The architecture consists of several Organizational Units (OUs), including a Security OU, a Workloads OU (which contains production and development accounts), and a Sandbox OU for developer experimentation. The Solutions Architect must implement the following governance requirements:

1. Prevent any development and production accounts in the Workloads OU from disabling AWS Config.
2. Ensure that accounts in the Sandbox OU cannot create virtual private cloud (VPC) peering connections or Transit Gateway attachments, preventing them from connecting to corporate networks.

Which of the following actions should the Solutions Architect take to meet these requirements? (Select TWO.)

  1. Create a Service Control Policy (SCP) that denies the config:DeleteConfigurationRecorder, config:DeleteDeliveryChannel, and config:StopConfigurationRecorder actions. Attach this SCP to the Workloads OU.Answer
  2. Create a Service Control Policy (SCP) that denies the ec2:CreateVpcPeeringConnection and ec2:CreateTransitGatewayAttachment actions. Attach this SCP to the Sandbox OU.Answer
  3. C
    Create an IAM group in the management account with policies that deny AWS Config modifications and EC2 network attachments, and associate this group with the OUs.
  4. D
    Modify the Transit Gateway route tables in the shared services account to block all traffic originating from the Sandbox accounts, and delete all local route table entries in the member accounts.
  5. E
    Configure a SAML 2.0 identity provider (IdP) in the management account and map user groups to trust policies that explicitly deny network creation actions in the Sandbox accounts.

Answer

Create a Service Control Policy (SCP) to deny AWS Config deletion/stop actions and attach it to the Workloads OU, and create a second SCP to deny VPC peering and Transit Gateway attachment creation and attach it to the Sandbox OU.
To enforce governance controls across multiple accounts within specific OUs, Service Control Policies (SCPs) are the primary mechanism. Attaching an SCP to the Workloads OU that denies AWS Config deletion/stop operations prevents administrators in those member accounts from turning off compliance auditing. Similarly, attaching an SCP to the Sandbox OU that denies the creation of VPC peering connections and Transit Gateway attachments prevents resource linkage at the API level, ensuring absolute network isolation of the sandbox environment.

Step-by-Step Solution

1
Define a Service Control Policy (SCP) to restrict AWS Config modifications.
An SCP is drafted with Deny statements for config:DeleteConfigurationRecorder, config:DeleteDeliveryChannel, and config:StopConfigurationRecorder.
To prevent local administrators in the Workloads OU from disabling compliance auditing.
2
Attach the AWS Config restriction SCP to the Workloads OU.
The SCP is linked to the Workloads OU, applying the restriction to all production and development accounts nested under it.
To enforce the configuration policy at the OU boundary.
3
Define an SCP to restrict VPC Peering and Transit Gateway attachment creation.
An SCP is drafted with Deny statements for ec2:CreateVpcPeeringConnection and ec2:CreateTransitGatewayAttachment.
To prevent sandbox environments from connecting to other network segments.
4
Attach the network restriction SCP to the Sandbox OU.
The SCP is linked to the Sandbox OU, restricting network creation capability for all sandbox accounts.
To ensure isolation requirements are strictly enforced.

Key Concept

Service Control Policies (SCPs) are security policies that you can use to manage permissions in your organization, offering central control over the maximum available permissions for all accounts in your organization or specific OUs.
Rate this question

Topics

Multi-Account Governance and Organizational Structure

More questions from this topic