Examkin

Question

Difficulty: HardMulti-Account Governance and Organizational Structure

A multinational e-commerce corporation manages its cloud environment using AWS Organizations. The security team requires a multi-account governance strategy that meets the following criteria:

1. Developers in the Development Organizational Unit (OU) must have the flexibility to experiment with new AWS services, but they must be prevented from disabling CloudTrail or altering IAM roles provisioned by the central security team.
2. In the Production OU, administrators must be restricted to launching only approved EC2 instance types, and all EBS volumes must be encrypted using a Customer Managed Key (CMK) owned by the central security account.
3. Local administrators must not be able to bypass these restrictions, and the solution should minimize operational overhead.

Which two of the following strategies should the solutions architect implement to meet these requirements? (Select TWO.)

  1. Apply an SCP to the Production OU that denies the ec2:RunInstances action if the instance type is not in the approved list, or if the EBS volume is not encrypted using the specified Customer Managed Key (CMK) ARN from the central security account.Answer
  2. Apply an SCP to the Root of the organization that denies modifications to CloudTrail configurations and denies modifications to IAM roles that begin with a specific path or prefix reserved for the central security team.Answer
  3. C
    Attach an SCP to the Production OU that forces all EBS volumes to be encrypted with the AWS-managed KMS key (aws/ebs) of the central security account to avoid the administrative overhead of managing key policies.
  4. D
    Create an IAM permission boundary in the Development OU that grants full access to all services while blocking IAM role deletions and CloudTrail modifications, assuming this boundary automatically grants these permissions to all developers.
  5. E
    Use AWS Resource Access Manager (RAM) to share the central security account's default EBS encryption configuration and AWS-managed keys with the member accounts to enforce organization-wide encryption.

Answer

Apply an SCP to the Production OU enforcing approved instance types and encryption with the central Customer Managed Key (CMK), and apply an SCP to the Root of the organization to deny modifications to CloudTrail configurations and central security IAM roles.
The correct strategy uses Service Control Policies (SCPs) to implement guardrails that local administrators cannot override. Applying an SCP at the Root level protects central IAM roles and CloudTrail configurations organization-wide (covering both Development and Production OUs). Enforcing EC2 instance types and the use of the central Customer Managed Key (CMK) via a Production OU SCP ensures compliance while allowing cross-account encryption, since the central CMK key policy can be updated to delegate usage rights to the production accounts.

Step-by-Step Solution

1
Determine the scope of the governance rules for general protection.
Identify that CloudTrail protection and central IAM role protection must apply globally, including to the Development OU.
SCPs attached to the Root of the organization automatically inherit down the entire OU hierarchy, providing a global safeguard.
2
Determine the scope and requirements of the Production OU restrictions.
Identify that production instances must use specific types and that EBS volumes must use a Customer Managed Key from the central security account.
AWS-managed keys cannot be shared across accounts. A Customer Managed Key in the central security account must be used and shared via its key policy, while an SCP on the Production OU enforces its usage.
3
Formulate the SCP policies and attach them to the appropriate levels.
Create a Root-level SCP for global resource protection and a Production-level SCP to restrict EC2 run instances properties.
This configuration meets all constraints with minimal administrative overhead and prevents local administrators from overriding the policies.

Key Concept

Using Service Control Policies (SCPs) in AWS Organizations to establish multi-account security guardrails, understanding that SCPs act as filters rather than direct permission grants, and knowing how cross-account KMS key sharing functions.
Rate this question

Topics

Multi-Account Governance and Organizational Structure

More questions from this topic