Examkin

Question

Difficulty: MediumMulti-Account Governance and Organizational Structure

An online gaming studio uses AWS Organizations to manage its game development, testing, and production environments. The environment includes a parent organizational unit (OU) called Engineering, which contains a child OU named Game-Dev for individual game development teams. To maintain compliance, the security team has deployed a centralized auditing IAM role named SecurityAuditRole in all member accounts under the Game-Dev OU. The security team wants to ensure that local administrators in the Game-Dev accounts cannot delete, modify, or detach policies from the SecurityAuditRole, while still retaining full administrative control over other resources. Which solution should the solutions architect implement to meet these requirements with the least administrative effort?

  1. Attach a Service Control Policy (SCP) to the Game-Dev OU that denies iam:DeleteRole, iam:UpdateAssumeRolePolicy, iam:PutRolePolicy, iam:DeleteRolePolicy, iam:AttachRolePolicy, and iam:DetachRolePolicy actions when the resource is the SecurityAuditRole ARN.Answer
  2. B
    Define an IAM Permission Boundary in the Game-Dev member accounts that denies modifications to the SecurityAuditRole, and require all developers to attach this boundary when creating new IAM users or roles.
  3. C
    Configure a SAML 2.0 identity provider (IdP) in each member account and configure the trust policy of SecurityAuditRole to allow access only from the central security account's IdP entity.
  4. D
    Enable AWS KMS encryption using an AWS-managed key (aws/iam) in the management account to encrypt the configuration of the SecurityAuditRole, and restrict access to this key.

Answer

Attach a Service Control Policy (SCP) to the Game-Dev OU that denies resource-modifying and deleting actions on the SecurityAuditRole.
Attaching a Service Control Policy (SCP) to the OU restricts permissions for all IAM entities in the member accounts, including the local administrators. By denying IAM modification and deletion actions specifically on the Amazon Resource Name (ARN) of the central audit role, the organization ensures the role remains intact. SCPs act as guardrails and do not require modification of individual IAM policies, making this the most operationally efficient method.

Step-by-Step Solution

1
Identify the organizational boundary where the governance rule must be enforced. Since the target is the Game-Dev accounts, the policy should be attached to the Game-Dev OU.
Enforcement targets the entire organizational unit containing the member accounts.
Attaching policies at the OU level ensures inheritance across all current and future accounts under that OU.
2
Write a Service Control Policy (SCP) that specifies an explicit Deny for iam:DeleteRole, iam:UpdateAssumeRolePolicy, iam:PutRolePolicy, iam:DeleteRolePolicy, iam:AttachRolePolicy, and iam:DetachRolePolicy actions.
A policy document containing the specified Deny actions is generated.
An explicit Deny in an SCP overrides any local administrator permissions in the member accounts.
3
Apply a resource constraint in the SCP to limit the Deny rule to only affect the specific ARN of the SecurityAuditRole.
The SCP restricts operations only on the specified role.
This maintains administrative flexibility in the member accounts, allowing local admins to manage other roles.

Key Concept

Service Control Policies (SCPs) act as organizational guardrails to restrict permissions in member accounts without granting permissions directly.
Estimated Time:2m 0s
Rate this question

Topics

Multi-Account Governance and Organizational Structure

More questions from this topic