Examkin

Question

Difficulty: MediumMulti-Account Governance and Organizational Structure

A technology company manages its multi-account environment using AWS Organizations. The security team has established a dedicated Sandbox Organizational Unit (OU) for developers to experiment with new services. Developers are granted administrator privileges in their respective sandbox accounts to allow rapid prototyping. The security team has deployed a security audit tool that relies on a specific IAM role named SecurityAuditRole in every sandbox account. The security team must ensure that developers cannot delete or modify this role, its attached policies, or its trust relationships, even though the developers have administrator permissions in their accounts. Which strategy should a solutions architect implement to meet these requirements with the least operational overhead?

  1. Attach a Service Control Policy (SCP) to the Sandbox OU with a Deny effect on IAM write actions, such as iam:DeleteRole, iam:PutRolePolicy, and iam:UpdateAssumeRolePolicy, when the resource is the ARN of the SecurityAuditRole. Use local IAM policies in the sandbox accounts to grant developer permissions.Answer
  2. B
    Attach a Service Control Policy (SCP) to the Sandbox OU that allows standard development actions but denies access to the SecurityAuditRole. Do not create local IAM policies or roles in the sandbox accounts, relying on the SCP to grant administrative access.
  3. C
    Configure a SAML 2.0 federated identity provider in each sandbox account, and attach an IAM permissions boundary to the federated role that denies modifications to the SecurityAuditRole while allowing all other administrator permissions.
  4. D
    Establish a centralized S3 bucket policy in a logging account that denies IAM deletion API requests originating from the sandbox accounts, and point the sandbox accounts' audit tools to write to this bucket.

Answer

Attach a Service Control Policy (SCP) to the Sandbox OU with a Deny effect on IAM write actions (such as iam:DeleteRole, iam:PutRolePolicy, and iam:UpdateAssumeRolePolicy) targeting the SecurityAuditRole resource ARN, while using local IAM policies to grant administrator access.
The correct strategy is to attach a Service Control Policy (SCP) to the Sandbox OU that denies write actions on the specific IAM role. SCPs act as guardrails that apply to all IAM entities in the member accounts, including the root user and administrators. Even if a developer has administrator privileges in a sandbox account, they cannot override a Deny action defined in an SCP. This ensures the integrity of the audit role with minimal operational overhead.

Step-by-Step Solution

1
Analyze the account structure and user privileges.
Developers have administrator permissions in sandbox accounts under a dedicated OU, meaning they can bypass local IAM restrictions and permission boundaries.
To identify the scope of enforcement needed to block administrators from modifying specific resources.
2
Select the appropriate policy type to override administrator permissions.
Service Control Policies (SCPs) apply to all users and roles in member accounts, including administrators.
SCPs are the only mechanism in AWS Organizations that can restrict the actions of local administrator users and roles.
3
Define the SCP rule with a explicit Deny effect on the role.
Create a Deny rule on IAM write actions, specifying the resource ARN of the SecurityAuditRole.
This prevents anyone in the sandbox accounts from modifying or deleting the audit role while still permitting all other administrator actions.

Key Concept

Service Control Policies (SCPs) in AWS Organizations define guardrails that local administrators cannot override.
Rate this question

Topics

Multi-Account Governance and Organizational Structure

More questions from this topic