Examkin

Question

Difficulty: MediumMulti-Account Governance and Organizational Structure

An enterprise is expanding its AWS environment by migrating several regional e-commerce workloads into separate AWS accounts under a single organization in AWS Organizations. The security team has defined the following requirements:

1. Workloads must only be deployed within a set of approved AWS Regions.
2. Member accounts must not be able to disable or modify the compliance monitoring rules established by the security team.
3. Developers must maintain administrative privileges within their dedicated development accounts.

Which two actions should a Solutions Architect take to implement these controls? (Select TWO.)

  1. Create and attach a Service Control Policy (SCP) to the organization's root or relevant Organizational Units (OUs) that denies resource creation in non-approved Regions and denies modification of AWS Config resources.Answer
  2. Deploy the compliance monitoring rules as AWS Config organizational rules from the organization's management account.Answer
  3. C
    Create an IAM policy with permissions boundaries and rely on IAM permission inheritance to automatically restrict local administrator roles in the member accounts.
  4. D
    Configure an Amazon S3 bucket policy in a centralized logging account that denies all write operations originating from non-approved AWS Regions.
  5. E
    Use AWS Resource Access Manager (RAM) to share the central security account's IAM roles and AWS Config configurations with the member accounts.

Answer

Deploy the compliance monitoring rules as AWS Config organizational rules from the organization's management account, and create and attach a Service Control Policy (SCP) to the organization's root or relevant Organizational Units (OUs) that denies resource creation in non-approved Regions and denies modification of AWS Config resources.
Deploying AWS Config rules as organizational rules ensures that they are automatically created in all member accounts and can only be modified or deleted by the organization's management account. Attaching an SCP at the OU or organization root level enforces absolute regional restrictions and prevents modification of Config resources, acting as a guardrail that local administrators cannot override.

Step-by-Step Solution

1
Analyze the constraints placed on developer accounts and compliance enforcement.
Developers must retain administrator privileges, meaning they can bypass local IAM controls and modify local resources. Therefore, organization-level guardrails must be utilized.
Local IAM policies or boundaries are insufficient because local administrators can alter them.
2
Address region lock and local resource protection requirements.
Identify that a Service Control Policy (SCP) attached to the OU or root is needed to enforce regional constraints and block modification of AWS Config.
SCPs apply to all principles in member accounts (including root and administrators) and cannot be overridden locally.
3
Ensure compliance rules cannot be modified by member accounts.
Identify that AWS Config rules should be deployed as organizational rules from the management account.
Rules deployed at the organization level are read-only in member accounts and cannot be deleted or edited by local administrators.

Key Concept

Enforcing multi-account governance requires utilizing Service Control Policies (SCPs) to set global guardrails (such as regional restrictions and resource protection) and AWS Config organizational rules to deploy tamper-proof compliance rules across all accounts.
Estimated Time:2m 0s
Rate this question

Topics

Multi-Account Governance and Organizational Structure

More questions from this topic