Examkin

Question

Difficulty: MediumMulti-Account Governance and Organizational Structure

An enterprise is designing a multi-account architecture using AWS Organizations. The security team wants to establish a governance framework where member accounts are prevented from leaving the organization or disabling AWS Config. Additionally, a central compliance auditing application hosted in a dedicated Security account must be able to periodically assess resource configurations across all member accounts.

Which two configurations should a Solutions Architect implement to meet these requirements?

  1. Attach a Service Control Policy (SCP) to the organization root that denies the organizations:LeaveOrganization and config:StopConfigurationRecorder actions.Answer
  2. Create an IAM role in each member account with the necessary read-only permissions and a trust policy that allows the Security account's compliance application role to assume it.Answer
  3. C
    Attach a Service Control Policy (SCP) to the member accounts' Organizational Unit (OU) that explicitly allows the sts:AssumeRole action for the Security account's role to grant cross-account access.
  4. D
    Encrypt the configuration logs in the member accounts using the default AWS managed key for AWS Config (aws/config) and update its key policy to allow cross-account access from the Security account.
  5. E
    Use AWS Resource Access Manager (RAM) to share the AWS Config delivery channels and configuration recorders from each member account with the Security account.

Answer

The correct configurations are attaching a Service Control Policy (SCP) to the organization root to deny organizations:LeaveOrganization and config:StopConfigurationRecorder, and creating an IAM role in each member account with read-only permissions and a trust policy that allows the Security account's compliance application role to assume it.
Attaching a Service Control Policy (SCP) at the root level of the organization ensures that guardrails are applied globally to prevent member accounts from leaving the organization or stopping the AWS Config recorder. Additionally, cross-account access is established by creating IAM roles in the member accounts that trust the compliance application's role in the Security account, allowing the compliance application to assume those roles and read resource configuration data.

Step-by-Step Solution

1
Enforce organization membership and config guardrails.
Attach an SCP at the root level of the AWS Organization to prevent member accounts from leaving the organization and disabling AWS Config.
SCPs act as organizational guardrails that define the maximum available permissions for member accounts.
2
Establish cross-account access.
Create a read-only IAM role in each member account and configure its trust policy to trust the compliance role in the Security account.
SCPs do not grant permissions; IAM roles and policies must be explicitly configured in the target accounts to grant cross-account access.

Key Concept

AWS Organizations Service Control Policies act as permission guardrails (not permission granters), and cross-account access must be explicitly authorized using IAM roles and trust policies.

Alternative Method

Instead of manual IAM role creation, AWS Control Tower or AWS Organizations StackSets can be used to automatically deploy the compliance IAM roles to all new and existing member accounts.
Estimated Time:3m 0s
Rate this question

Topics

Multi-Account Governance and Organizational Structure

More questions from this topic