Examkin

Question

Difficulty: HardMulti-Account Governance and Organizational Structure

An enterprise is planning to establish a secure multi-account landing zone. The solutions architect needs to migrate several legacy standalone AWS accounts into a new AWS Organizations structure and implement centralized governance. The goals are to enforce strict preventive guardrails, enable centralized security monitoring, and provide federated access. Arrange the following implementation steps in the correct logical sequence to achieve these goals with the minimum window of security vulnerability.

  1. 1Create the new AWS Organization in the management account and establish the Organizational Unit (OU) structure, including dedicated Security and Workloads OUs.
  2. 2Invite the legacy standalone AWS accounts to join the new organization, accept the invitations, and move the accounts into their respective OUs.
  3. 3Designate the Security account as the delegated administrator for AWS Config and Amazon GuardDuty, enabling organization-wide auto-enrollment for all member accounts.
  4. 4Create and attach Service Control Policies (SCPs) to the Workloads OU to restrict unauthorized AWS Regions and prevent modifications to security resources.
  5. 5Configure AWS IAM Identity Center, synchronize directory groups, and provision permission sets to grant users federated access to the member accounts.

Answer

The correct order of implementation is first creating the organization and OUs, onboarding the legacy accounts into the organization, delegating security administration to establish monitoring, applying Service Control Policies to enforce guardrails, and finally provisioning federated access using AWS IAM Identity Center.
The correct order follows the principle of secure landing zone setup. First, the organization structure is built. Second, the accounts are enrolled as members. Third, delegated admin and organization-wide security monitoring are turned on to ensure auditing is ready. Fourth, preventive SCPs are attached to OUs to secure the environment. Finally, federated access is provisioned so that users operate under a fully audited and locked-down environment from their very first login.

Step-by-Step Solution

1
Establish AWS Organizations and create OUs
The organizational hierarchy is ready to receive accounts.
A root management account must initiate the organization before any members or structures can exist.
2
Invite and join standalone accounts to the organization
Member accounts are enrolled and grouped into OUs.
Accounts must be organizational members to inherit policies and participate in delegated administration.
3
Configure delegated administration for security monitoring
Centralized auditing is active across all member accounts.
Ensuring visibility and security logging is established before any developer or operator access is allowed.
4
Apply preventive SCPs to OUs
Guardrails are active, preventing unauthorized API calls.
Attaching SCPs before users gain access eliminates the risk of security violations during the initial access window.
5
Provision federated access via AWS IAM Identity Center
Users can log in with permissions regulated by both IAM and SCPs.
Federation is enabled last to ensure all operations are fully governed and monitored from day one.

Key Concept

Multi-Account Governance Bootstrapping Sequence
Rate this question

Topics

Multi-Account Governance and Organizational Structure

More questions from this topic