Examkin

Question

Difficulty: Very hardMulti-Account Governance and Organizational Structure

An enterprise is designing a multi-account structure using AWS Organizations. The architecture includes a Production Organizational Unit (OU) containing several workload accounts, and a Shared Services OU. The security team has established the following requirements:

1. Workloads in the Production OU must be restricted to deploying resources only in the `eu-west-1` and `us-east-1` Regions, with exemptions for global services such as Amazon Route 53, AWS IAM, and Amazon CloudFront.
2. Local administrators in member accounts within the Production OU must be prevented from deleting or modifying a centralized administrative IAM role named `CentralAuditRole` that is deployed in all member accounts.
3. No member account within the organization must be permitted to leave the organization.
4. The solution must minimize administrative overhead and avoid complex per-account manual configurations.

Which approach should the solutions architect recommend to meet these requirements?

  1. A
    Attach an SCP at the Organization Root to deny organizations:LeaveOrganization. Implement an IAM Permission Boundary in each production account that restricts regions and protects the CentralAuditRole, and require all administrative users to have this boundary attached.
  2. Attach an SCP at the Organization Root to deny organizations:LeaveOrganization. Attach an SCP at the Production OU that denies resource creation if aws:RequestedRegion is not eu-west-1 or us-east-1 (exempting global services), and denies write and delete actions on the CentralAuditRole ARN using a wildcard for the account ID.Answer
  3. C
    Attach an SCP at the Organization Root to deny organizations:LeaveOrganization and to explicitly allow resource creation only in eu-west-1 and us-east-1. Modify the IAM trust policy of the CentralAuditRole in each account to deny iam:DeleteRole and iam:UpdateRolePolicy actions for any local administrator principal.
  4. D
    Create a Customer Managed Key (CMK) in the centralized security account. Use this key to encrypt all IAM configurations in member accounts. Attach an SCP at the Production OU that denies any modifications to resources unless the caller is authorized by the CMK policy, and restricts regions to eu-west-1 and us-east-1.

Answer

The correct design uses a Service Control Policy (SCP) at the root level to prevent accounts from leaving the organization, and a separate SCP at the Production OU to restrict regions (with global service exemptions) and block modifications to the specific IAM role across all member accounts using a wildcard resource ARN.
The correct solution uses a Root-level SCP to prevent member accounts from leaving the organization, and a Production OU-level SCP to enforce region boundaries and protect the administrative role. SCPs are effective policy boundaries that cannot be bypassed by local administrators. Using a wildcard in the resource ARN allows a single policy to protect the role across all member accounts, minimizing administrative overhead.

Step-by-Step Solution

1
Evaluate enforcement mechanism for organization member policy.
Identify that organizations:LeaveOrganization must be denied at the root level to prevent any member account in the organization from leaving.
An SCP applied at the Root OU automatically inherits down to all OUs and accounts, providing a global policy guardrail.
2
Evaluate regional deployment restrictions.
Determine that an SCP denying actions where the condition key aws:RequestedRegion is not eu-west-1 or us-east-1 (with exemptions for global services) should be applied to the Production OU.
Applying this at the Production OU ensures sandbox or shared services OUs are not unnecessarily restricted, and exempting global services prevents breaking IAM, CloudFront, and Route 53 operations.
3
Determine how to protect the central audit role from local administrators.
Deny write/delete operations (e.g., iam:DeleteRole, iam:PutRolePolicy) on the CentralAuditRole resource ARN using a wildcard for the account ID field (arn:aws:iam::*:role/CentralAuditRole).
SCPs apply to all principals in the member accounts, including the root user and administrators. Using a wildcard in the account ID part of the ARN allows one policy to protect the role across all accounts in the Production OU without individual account hardcoding.

Key Concept

Multi-Account Governance and Organizational Structure
Estimated Time:3m 0s
Rate this question

Topics

Multi-Account Governance and Organizational Structure

More questions from this topic