Examkin

Question

Difficulty: HardMulti-Account Governance and Organizational Structure

An enterprise is designing a multi-account AWS environment using AWS Organizations. The security team has defined the following governance requirements that must be enforced across all member accounts:
1. Prevent any member account from leaving the organization.
2. Ensure that AWS CloudTrail trails and AWS Config configuration recorders or delivery channels cannot be deleted or disabled by any user, including administrative and root users.
3. Restrict resource creation to only the `us-east-1` and `eu-west-1` regions, while ensuring that global services (such as IAM, Amazon CloudFront, and Amazon Route 53) remain fully operational.

Which TWO of the following configurations should the solutions architect implement to meet these requirements?

  1. Apply a Service Control Policy (SCP) to the organization root that denies organizations:LeaveOrganization, cloudtrail:StopLogging, cloudtrail:DeleteTrail, cloudtrail:UpdateTrail, config:DeleteConfigurationRecorder, and config:DeleteDeliveryChannel.Answer
  2. B
    Apply a Service Control Policy (SCP) to the target OUs that uses an Allow effect to permit administrative operations only within the us-east-1 and eu-west-1 regions, which will automatically grant local permissions to IAM roles within those regions.
  3. Apply a Service Control Policy (SCP) to the target OUs that denies all actions if the aws:RequestedRegion condition key does not match us-east-1 or eu-west-1, except for actions matching global services (such as iam:*, cloudfront:*, and route53:*) inside a NotAction block.Answer
  4. D
    Apply a Service Control Policy (SCP) that restricts KMS key usage by specifying the AWS-managed KMS key for CloudTrail (aws/cloudtrail) in the Resource element to delegate cross-account key management privileges, assuming AWS-managed keys support custom policy delegation.
  5. E
    Configure the centralized Amazon S3 bucket policy for CloudTrail logging to grant write access using only the aws:PrincipalOrgID condition key while leaving the Principal element empty to simplify bucket-level access control across all accounts.

Answer

The correct configurations are to apply an SCP at the organization root that denies leaving the organization and deleting configuration recorders, delivery channels, trails, or stopping logging; and to apply another SCP that denies all regional actions outside of the allowed regions unless the actions match global services within a NotAction block.
The correct options properly leverage SCPs to enforce boundaries. The SCP that denies leaving the organization and disabling auditing tools prevents administrative override in member accounts, securing the compliance baseline. The region-restriction SCP uses the Deny-NotAction pattern to restrict regional activities to us-east-1 and eu-west-1 while allowing essential global API operations to function.

Step-by-Step Solution

1
Address the requirement to prevent organization departure and disablement of monitoring tools.
Identify that Service Control Policies (SCPs) with an explicit Deny are required to prevent member accounts (including root users) from calling organizations:LeaveOrganization, cloudtrail:StopLogging, and config:DeleteConfigurationRecorder.
SCPs define the maximum permissions for an account. An explicit Deny in an SCP overrides any administrative or root-level permissions in member accounts.
2
Address the geographical restriction requirement without breaking global services.
Formulate a policy with a Deny effect targeting the aws:RequestedRegion key for all regions except us-east-1 and eu-west-1, while nesting global services in a NotAction block.
Global services do not have regional endpoints or execute in us-east-1, meaning a blanket region lock would disrupt core IAM, CloudFront, and Route 53 operations.

Key Concept

Using Service Control Policies (SCPs) to enforce organization-wide governance, regional boundaries, and audit protection without granting permissions directly.
Rate this question

Topics

Multi-Account Governance and Organizational Structure

More questions from this topic