Examkin

Question

Difficulty: MediumMulti-Account Governance and Organizational Structure

An international retail enterprise manages its AWS environment using AWS Organizations. The security team has designated a dedicated Security account as the delegated administrator for Amazon GuardDuty. The team needs to enforce a policy that prevents member accounts in the Workloads Organizational Unit (OU) from disabling GuardDuty or deleting its detectors. However, the dedicated Security account must retain full administrative privileges to manage GuardDuty across the entire organization. Which of the following represents the most operationally efficient method to achieve this governance requirement?

  1. Create a Service Control Policy (SCP) that denies guardduty:Delete* and guardduty:Update* actions. Attach this SCP to the Workloads OU, and place the delegated administrator Security account in a separate Security OU that does not have this SCP attached.Answer
  2. B
    Create a Service Control Policy (SCP) that explicitly grants GuardDuty administrative actions only for the delegated administrator Security account's roles, and attach this SCP to the Root of the organization to grant these permissions to all member accounts.
  3. C
    Establish cross-account IAM roles in each workload account that trust the Security account using a SAML 2.0 identity provider. In the trust policy of these roles, configure the principal to use the security account's SAML provider without specifying the sts:AssumeRoleWithSAML action.
  4. D
    Configure a centralized Amazon S3 bucket policy in the Security account to store GuardDuty findings, and write a policy that denies s3:PutObject permissions to any member account that attempts to transmit a disabled status event.

Answer

Create a Service Control Policy (SCP) that denies guardduty:Delete* and guardduty:Update* actions. Attach this SCP to the Workloads OU, and place the delegated administrator Security account in a separate Security OU that does not have this SCP attached.
The correct option is to create a Service Control Policy (SCP) denying the relevant delete and update actions and attach it to the Workloads OU while placing the Security account in a separate OU. This utilizes AWS Organizations' hierarchical structure to restrict workload accounts while exempting the delegated administrator, satisfying all requirements with minimal administrative overhead.

Step-by-Step Solution

1
Analyze the account structure and requirements.
Identify that the dedicated Security account needs admin permissions, while workload accounts must be restricted from deleting or disabling GuardDuty.
To determine how to apply guardrails selectively based on account function.
2
Determine the placement of the delegated administrator account.
Place the Security account in a dedicated Security OU separate from the Workloads OU.
SCPs attached to an OU do not inherit across sibling OUs, allowing selective enforcement.
3
Create and attach the SCP to the Workloads OU.
Attach an SCP denying guardduty:Delete* and guardduty:Update* to the Workloads OU.
This blocks local administrators in workload accounts from tampering with GuardDuty while leaving the Security account unaffected.

Key Concept

Delegated administration and OU-scoped Service Control Policies
Rate this question

Topics

Multi-Account Governance and Organizational Structure

More questions from this topic