Examkin

Question

Difficulty: HardMulti-Account Governance and Organizational Structure

A multinational logistics provider manages its multi-account environment using AWS Organizations. The environment is organized into several Organizational Units (OUs), including Workloads-OU and Security-OU. The Cloud Security team must implement a security and compliance governance framework that satisfies the following requirements:
1. Audit Centralization: AWS Config must be configured using a delegated administrator account (Auditor-Account) inside Security-OU to manage and deploy compliance rules across all member accounts.
2. Guardrails: Prevent any user or role in the Workloads-OU (including administrators) from modifying, deleting, or stopping AWS Config configuration recorders or delivery channels.
3. Log Integrity: AWS CloudTrail must deliver organizational trails to a central Amazon S3 bucket in the Auditor-Account with Server-Side Encryption with AWS KMS (SSE-KMS) enabled.
4. Data Protection: Application workloads in the Workloads-OU must encrypt their application secrets in AWS Systems Manager (SSM) Parameter Store using the same KMS key managed in the Auditor-Account.

Which of the following configurations represents the most secure and operationally efficient architecture to meet these requirements?

  1. Register the Auditor-Account as the delegated administrator for AWS Config. Attach an SCP to the Workloads-OU that denies the config:DeleteConfigurationRecorder, config:DeleteDeliveryChannel, and config:StopConfigurationRecorder actions. In the Auditor-Account, create a KMS Customer Managed Key (CMK) and configure its key policy to allow workload IAM roles in the Workloads-OU to perform cryptographic operations. Configure the S3 bucket policy in the Auditor-Account to allow the cloudtrail.amazonaws.com service principal to write logs.Answer
  2. B
    Register the Auditor-Account as the delegated administrator for AWS Config. Attach an SCP to the Workloads-OU that denies the config:DeleteConfigurationRecorder, config:DeleteDeliveryChannel, and config:StopConfigurationRecorder actions. In the Auditor-Account, configure the S3 bucket policy to allow the cloudtrail.amazonaws.com service principal to write logs. Encrypt the SSM parameters using the default AWS-managed KMS key 'aws/ssm' in the Auditor-Account and grant permissions to the workloads in the Workloads-OU.
  3. C
    Register the Auditor-Account as the delegated administrator for AWS Config. Attach an SCP to the Workloads-OU that explicitly allows the required AWS Config operations for compliance roles, assuming this grants the necessary permissions. In the Auditor-Account, create a KMS Customer Managed Key (CMK) and configure its key policy to allow workload IAM roles in the Workloads-OU to perform cryptographic operations. Configure the S3 bucket policy in the Auditor-Account to allow the cloudtrail.amazonaws.com service principal to write logs.
  4. D
    Register the Auditor-Account as the delegated administrator for AWS Config. Attach an SCP to the Workloads-OU that denies the config:DeleteConfigurationRecorder, config:DeleteDeliveryChannel, and config:StopConfigurationRecorder actions. In the Auditor-Account, create a KMS Customer Managed Key (CMK) and configure its key policy to allow workload IAM roles in the Workloads-OU to perform cryptographic operations. Configure the S3 bucket policy in the Auditor-Account to rely on default S3 bucket Access Control Lists (ACLs) and the management account's administrative role to deliver CloudTrail logs.

Answer

The configuration that registers the Auditor-Account as the delegated administrator, uses an SCP to deny AWS Config changes on the Workloads-OU, creates a Customer Managed Key with cross-account access, and configures the S3 bucket policy to allow the CloudTrail service principal to deliver logs.
The correct solution registers the Auditor-Account as the delegated administrator for AWS Config, isolates audit functions, and uses an SCP to restrict changes in the Workloads-OU. For cross-account encryption, a Customer Managed Key (CMK) is used with a key policy granting access to workload roles. Finally, the centralized S3 bucket policy is configured to allow the CloudTrail service principal to deliver logs successfully.

Step-by-Step Solution

1
Set up Delegated Administrator for AWS Config.
Allows Auditor-Account to deploy and monitor rules organization-wide without accessing the Organizations management account directly.
Aligns with AWS best practices for multi-account security governance by decoupling configuration monitoring from administrative privileges.
2
Create and attach the Service Control Policy (SCP).
Ensures that member accounts under Workloads-OU cannot stop or delete AWS Config recorders and delivery channels, even if they have administrative privileges.
Maintains baseline auditability across the workloads environment.
3
Create and configure a Customer Managed Key (CMK) in the Auditor-Account.
Enables cross-account parameter encryption in SSM Parameter Store.
AWS-managed keys (like aws/ssm) cannot be shared across AWS accounts, making CMKs mandatory for cross-account encryption requirements.
4
Configure the S3 bucket policy in the Auditor-Account.
Allows CloudTrail to successfully deliver log files from member accounts to the central logging bucket.
CloudTrail service principal must be explicitly permitted via S3 bucket policy for cross-account log delivery.

Key Concept

Multi-account governance using AWS Organizations, SCPs, Delegated Administrators, and cross-account resource access.
Estimated Time:3m 0s
Rate this question

Topics

Multi-Account Governance and Organizational Structure

More questions from this topic