Examkin

Question

Difficulty: MediumMulti-Account Governance and Organizational Structure

A healthcare provider hosts HIPAA-compliant applications across multiple AWS accounts managed under a single organization in AWS Organizations. The security team mandates that AWS Config must remain enabled and recording in all member accounts within the Workloads Organizational Unit (OU). Individual administrators in these member accounts must retain full administrator privileges (AdministratorAccess) to deploy workloads but must be prevented from stopping the configuration recorder, deleting the delivery channel, or modifying the configuration recorder settings. Which strategy will meet these requirements with the least operational overhead?

  1. Attach a Service Control Policy (SCP) to the Workloads Organizational Unit (OU) that denies the config:StopConfigurationRecorder, config:DeleteDeliveryChannel, and config:PutConfigurationRecorder actions.Answer
  2. B
    Attach a Service Control Policy (SCP) directly to the system administrator IAM roles in each member account that denies modifying or deleting AWS Config resources.
  3. C
    Use AWS Resource Access Manager (RAM) to share a standard IAM permissions boundary from the management account to all member accounts, restricting modification of AWS Config.
  4. D
    Configure AWS Config to encrypt all recording data using the default AWS-managed KMS key (aws/config), and update its key policy to deny access to the AWS Config APIs for member account administrators.

Answer

Attaching a Service Control Policy (SCP) to the Workloads Organizational Unit (OU) that denies the config:StopConfigurationRecorder, config:DeleteDeliveryChannel, and config:PutConfigurationRecorder actions.
Attaching a Service Control Policy (SCP) to the Workloads Organizational Unit (OU) with explicit deny actions for AWS Config modification effectively blocks all local administrators (and the root user) from disabling or tampering with AWS Config. This provides centralized governance with minimal operational effort.

Step-by-Step Solution

1
Determine the appropriate governance tool to enforce organization-wide security boundaries that affect even administrators.
Identify Service Control Policies (SCPs) as the correct tool.
SCPs define the maximum available permissions for member accounts and apply to all IAM users, roles, and the root user.
2
Construct an SCP with explicit deny rules for the specific AWS Config modification APIs.
Define config:StopConfigurationRecorder, config:DeleteDeliveryChannel, and config:PutConfigurationRecorder within the Deny block of the SCP statement.
An explicit deny in an SCP overrides any local administrator permissions.
3
Determine where to attach the SCP to restrict only the workloads accounts with minimal management effort.
Attach the SCP directly to the Workloads Organizational Unit (OU).
Attaching the policy to the OU applies the restrictions to all current and future member accounts within that OU automatically.

Key Concept

Using Service Control Policies (SCPs) in AWS Organizations as administrative guardrails to restrict member account administrators' permissions.
Rate this question

Topics

Multi-Account Governance and Organizational Structure

More questions from this topic