Examkin

Question

Difficulty: HardMulti-Account Governance and Organizational Structure

An enterprise manages its multi-account environment using AWS Organizations. The environment is structured with a Root OU, a Security OU containing a dedicated security auditing account, and a Workloads OU containing production application accounts. The enterprise's security posture mandates that:

- Development teams must be blocked from modifying, disabling, or deleting security services (Amazon GuardDuty, AWS CloudTrail, and AWS Config) within their workload accounts.
- The central security team must be able to perform emergency maintenance and updates on these configurations within the workload accounts using a pre-deployed IAM role named SecurityAdmin.
- Operational operations must be delegated away from the management account to maintain isolation.

Which solution meets these requirements with the least operational overhead?

  1. A
    Deploy an IAM permission boundary to all workload accounts. Require that all developer IAM users and roles have this boundary attached, which explicitly denies modifications to GuardDuty, CloudTrail, and AWS Config. Exclude the SecurityAdmin role from this boundary. Use AWS CloudFormation StackSets to deploy and update the boundary across all accounts.
  2. B
    Attach a Service Control Policy (SCP) to the Workloads OU that explicitly allows GuardDuty, CloudTrail, and AWS Config operations only for the SecurityAdmin role, and denies them to all other roles. Rely on this SCP to grant the necessary administrative permissions to the central security team without configuring local IAM policies in the workload accounts.
  3. Register the security auditing account as the delegated administrator for Amazon GuardDuty, AWS CloudTrail, and AWS Config. Apply a Service Control Policy (SCP) to the Workloads OU that denies modification and deletion of these security services, using a condition block with the ArnNotEquals key to exclude the SecurityAdmin role's ARN. Ensure local developer roles do not have permissions to assume or modify the SecurityAdmin role.Answer
  4. D
    Configure cross-account IAM roles in the workload accounts that trust the organization's management account. Use the management account to centrally deploy and manage the security configurations. Attach an SCP to the Workloads OU that denies all modifications and deletions of GuardDuty, CloudTrail, and AWS Config for all principals within the OU.

Answer

Register the security auditing account as the delegated administrator for GuardDuty, CloudTrail, and AWS Config. Apply a Service Control Policy (SCP) to the Workloads OU that denies modification and deletion of these security services, using a condition block with the ArnNotEquals key to exclude the SecurityAdmin role's ARN. Ensure local developer roles do not have permissions to assume or modify the SecurityAdmin role.
Registering the security auditing account as the delegated administrator isolates the management account from operational duties, satisfying a core AWS architectural best practice. Applying a Service Control Policy (SCP) at the Workloads OU level ensures the policy is applied to all member accounts globally. Using the 'ArnNotEquals' condition key on 'aws:PrincipalARN' allows the central 'SecurityAdmin' role to perform maintenance, while restricting developers and local administrators. Keeping local developers from assuming or modifying the security role ensures they cannot bypass the restriction.

Step-by-Step Solution

1
Register the dedicated security auditing account as the delegated administrator for the required AWS services (GuardDuty, CloudTrail, Config).
Enables the security auditing account to configure and manage these services organization-wide, keeping the management account isolated from operational tasks.
AWS best practices dictate isolating the management account and delegating service administration to dedicated operational accounts.
2
Draft a Service Control Policy (SCP) that restricts destructive and modification actions for GuardDuty, CloudTrail, and Config.
Creates a centralized guardrail that applies to all accounts within the target OU.
SCPs provide organization-wide restrictions that cannot be bypassed by local administrators in member accounts.
3
Incorporate a condition block in the SCP using the 'ArnNotEquals' key and the 'aws:PrincipalARN' global condition key to exclude the 'SecurityAdmin' role.
Exempts the 'SecurityAdmin' role from the deny effect, allowing the central security team to perform authorized modifications.
This conditional logic prevents the SCP from locking out authorized administrators while still restricting developers.
4
Attach the SCP to the Workloads OU and ensure developers are blocked from assuming or modifying the 'SecurityAdmin' role.
Enforces the policy across all target workload accounts and prevents developers from bypassing the restriction.
SCPs act as filters and do not grant permissions; ensuring local configuration controls prevent unauthorized privilege escalation is necessary to preserve the governance structure.

Key Concept

Delegated Administration and Service Control Policies with Conditional Exemptions
Estimated Time:2m 30s
Rate this question

Topics

Multi-Account Governance and Organizational Structure

More questions from this topic