A solutions architect is configuring a multi-account environment using AWS Organizations. The architect wants to prevent users in member accounts from stopping or deleting AWS CloudTrail. The architect attaches a Service Control Policy (SCP) to the organization's Root OU that explicitly denies the `cloudtrail:StopLogging` and `cloudtrail:DeleteTrail` actions. Which of the following is required for an IAM user in a member account to successfully create and manage a new CloudTrail trail in their own account?
- The IAM user must be explicitly granted the permission by an IAM policy attached to their identity in the member account, and the action must not be denied by any Service Control Policy.Answer
- BNo local IAM policy is required in the member account because attaching the SCP to the Root OU automatically grants the necessary CloudTrail permissions to all users within the organization.
- CThe IAM user must configure an S3 bucket policy in the management account that explicitly permits cross-account trail configuration.
- DThe IAM user must encrypt the new trail using an AWS-managed KMS key to delegate organization-wide management permissions.
Answer
The IAM user must be explicitly granted the permission by an IAM policy attached to their identity in the member account, and the action must not be denied by any Service Control Policy.
The correct answer is that the user must be explicitly granted the permission by an IAM policy in the member account, and the action must not be denied by any Service Control Policy. SCPs act as guardrails that limit the maximum permissions available in an account but do not grant permissions directly. Therefore, local IAM policies are still required.
Step-by-Step Solution
Key Concept
Interaction between Service Control Policies (SCPs) and IAM Policies