Question

Difficulty: EasyMulti-Account Governance and Organizational Structure

A solutions architect is configuring a multi-account environment using AWS Organizations. The architect wants to prevent users in member accounts from stopping or deleting AWS CloudTrail. The architect attaches a Service Control Policy (SCP) to the organization's Root OU that explicitly denies the `cloudtrail:StopLogging` and `cloudtrail:DeleteTrail` actions. Which of the following is required for an IAM user in a member account to successfully create and manage a new CloudTrail trail in their own account?

  1. The IAM user must be explicitly granted the permission by an IAM policy attached to their identity in the member account, and the action must not be denied by any Service Control Policy.Answer
  2. B
    No local IAM policy is required in the member account because attaching the SCP to the Root OU automatically grants the necessary CloudTrail permissions to all users within the organization.
  3. C
    The IAM user must configure an S3 bucket policy in the management account that explicitly permits cross-account trail configuration.
  4. D
    The IAM user must encrypt the new trail using an AWS-managed KMS key to delegate organization-wide management permissions.

Answer

The IAM user must be explicitly granted the permission by an IAM policy attached to their identity in the member account, and the action must not be denied by any Service Control Policy.
The correct answer is that the user must be explicitly granted the permission by an IAM policy in the member account, and the action must not be denied by any Service Control Policy. SCPs act as guardrails that limit the maximum permissions available in an account but do not grant permissions directly. Therefore, local IAM policies are still required.

Step-by-Step Solution

1
Analyze the impact of the Service Control Policy (SCP) attached to the Root OU.
The SCP denies `cloudtrail:StopLogging` and `cloudtrail:DeleteTrail` across all member accounts, meaning these actions can never be performed, but it does not grant permissions for any other action.
SCPs act as filters (guardrails) defining the maximum allowed permissions but do not grant access directly.
2
Determine how permissions are granted in a member account under AWS Organizations.
An IAM identity (user or role) in the member account must have an attached IAM policy that explicitly allows the required action (e.g., `cloudtrail:CreateTrail`).
Both the local IAM policy and the SCP must allow the action for the request to succeed.

Key Concept

Interaction between Service Control Policies (SCPs) and IAM Policies
Rate this question