Examkin

Question

Difficulty: HardMulti-Account Governance and Organizational Structure

A global media streaming provider has organized its cloud environment using AWS Organizations. The structure contains a root OU, a Production OU, and a Sandbox OU. The engineering team has the following governance requirements:

- Developers in Sandbox accounts require full administrative permissions to experiment but must be prevented from disabling AWS Security Hub or deleting its resources.
- Member accounts in the Production OU must only deploy resources in the us-east-1 and eu-west-1 regions.
- An emergency response team requires the ability to bypass the regional restrictions in the Production OU during active incidents to deploy resources globally, but this bypass must be restricted to a specific emergency IAM role (EmergencyAdminRole) that is only assumable via multi-factor authentication (MFA).

Which governance strategy should a solutions architect recommend to satisfy these requirements with the least operational overhead?

  1. Attach a Service Control Policy (SCP) to the Sandbox OU that denies securityhub:* actions. Attach an SCP to the Production OU that denies all actions except for global services and operations in us-east-1 and eu-west-1, with a Condition block that excludes the EmergencyAdminRole role and requires aws:MultiFactorAuthPresent to be true. Create the administrative and emergency roles locally in each member account with appropriate IAM policies.Answer
  2. B
    Attach an SCP to the Sandbox OU that grants administrator privileges to developers while denying securityhub:* actions. Attach an SCP to the Production OU that grants full access in us-east-1 and eu-west-1, and grants access to other regions only if the principal is the EmergencyAdminRole and aws:MultiFactorAuthPresent is true, eliminating the need to manage individual IAM policies in the member accounts.
  3. C
    Attach a permissions boundary to all developer roles in the Sandbox OU that permits all actions except securityhub:*. For the Production OU, create a custom AWS KMS customer managed key to encrypt all IAM policies, and use a cross-account IAM trust policy to allow the EmergencyAdminRole from the management account to assume roles in production accounts without MFA, since the trust policy inherits cross-account trust automatically.
  4. D
    Attach an SCP to the Sandbox OU that denies securityhub:* actions. For the Production OU, configure an AWS KMS key policy on an AWS-managed key (aws/kms) that denies encryption/decryption in other regions except for the EmergencyAdminRole. Use a Service Control Policy to restrict regions for all accounts, but disable the SCP dynamically using an AWS Lambda function triggered by AWS CloudTrail when the EmergencyAdminRole is assumed with MFA.

Answer

Attach an SCP to the Sandbox OU to deny Security Hub modification, attach an SCP to the Production OU to deny operations outside the approved regions except for the emergency role with MFA, and manage administrative permissions via local IAM policies.
The correct strategy uses an SCP on the Sandbox OU to restrict Security Hub access and an SCP on the Production OU to enforce regional compliance. By utilizing a Condition block with ArnNotEquals and aws:MultiFactorAuthPresent, the solutions architect can exempt the emergency role from regional restrictions when assumed with MFA. Local IAM policies must be maintained because SCPs only act as guardrails and do not grant permissions directly.

Step-by-Step Solution

1
Evaluate the mechanism to enforce Security Hub restrictions globally in Sandbox accounts.
Identify that a Service Control Policy (SCP) attached to the Sandbox OU denying securityhub:* is the most operationally efficient method as it applies to all principals including root.
SCPs act as guardrails that restrict permissions for all accounts under the OU, regardless of local IAM permissions.
2
Determine the strategy for regional restrictions with an emergency bypass in the Production OU.
Use an SCP with a Deny effect on actions outside us-east-1 and eu-west-1, except for global services. Use a Condition block with ArnNotEquals to exempt the EmergencyAdminRole and Bool to require aws:MultiFactorAuthPresent.
Exempting specific roles and requiring MFA ensures that only authorized incident response activities can bypass the guardrails.
3
Ensure alignment between SCP policies and IAM permission models.
Recognize that local IAM policies must still be created in each member account to grant administrative and emergency access.
SCPs do not grant permissions directly; they only set the maximum boundary of allowed permissions. Local IAM policies must grant the actual permissions.

Key Concept

AWS Organizations Service Control Policies (SCPs) act as permission boundaries and must be combined with local IAM policies to grant permissions. They support conditions to exempt specific roles and enforce MFA.
Estimated Time:3m 0s
Rate this question

Topics

Multi-Account Governance and Organizational Structure

More questions from this topic