Examkin

Question

Difficulty: HardMulti-Account Governance and Organizational Structure

A global financial technology enterprise manages a large multi-account environment using AWS Organizations. The company has a strict governance policy for its Compliance_OU, which houses accounts processing payment transactions, and its Developer_OU, which hosts sandbox environments. The Solutions Architect must enforce the following security requirements:
1. No user or role within the member accounts may delete or disable corporate AWS Config rules.
2. Developers in the Developer_OU must be allowed to create IAM roles and policies for testing, but they must be prevented from accessing any resources tagged with Confidentiality: High.
3. Accounts in the Compliance_OU must only be permitted to run services in the us-east-1 and us-west-2 regions, and must be restricted to using Amazon EC2, Amazon RDS, and Amazon DynamoDB.

Which combination of Service Control Policies (SCPs) and IAM configurations must the Solutions Architect implement to meet these requirements with the least administrative overhead?

  1. A
    Apply an SCP at the root level that denies deleting or disabling AWS Config rules. Apply an SCP to the Developer_OU that denies all actions on resources with the tag Confidentiality: High. Apply an SCP to the Compliance_OU that allows all actions for Amazon EC2, Amazon RDS, and Amazon DynamoDB, while restricting access to us-east-1 and us-west-2. Instruct local administrators that developers in the Compliance_OU accounts do not require local IAM policies, as this SCP automatically grants them access to these three services.
  2. B
    Apply an SCP at the root level to deny AWS Config rule modifications. In the Developer_OU accounts, configure IAM policies on every individual IAM user and role to deny access to resources tagged with Confidentiality: High. For the Compliance_OU accounts, use AWS Resource Access Manager (RAM) to share a pre-configured IAM role from the management account to all member accounts, allowing access only to EC2, RDS, and DynamoDB in us-east-1 and us-west-2.
  3. Apply a Service Control Policy (SCP) at the root level of the organization that denies config:DeleteConfigRule, config:DeleteConfigurationRecorder, and config:StopConfigurationRecorder. Apply an SCP to the Developer_OU that denies all actions on resources with the tag Confidentiality: High. Apply an SCP to the Compliance_OU that denies access to all AWS services except Amazon EC2, Amazon RDS, and Amazon DynamoDB (plus supporting services like IAM, KMS, and CloudWatch) and denies all actions outside us-east-1 and us-west-2 except for global services. Require local administrators to configure local IAM policies to grant users and roles permissions to access the approved services.Answer
  4. D
    Apply an SCP at the root level to deny AWS Config rule modifications. Attach an IAM policy to the Organization Root that denies access to resources with the tag Confidentiality: High. For the Compliance_OU accounts, restrict service access by configuring an AWS-managed KMS key (aws/s3) policy in the logging account to deny encrypt and decrypt actions for all services other than EC2, RDS, and DynamoDB, and apply this KMS key across all Compliance_OU accounts.

Answer

The correct answer is the solution that applies a Service Control Policy (SCP) at the root level to deny AWS Config modifications, applies an SCP to the Developer_OU using resource tags, applies an SCP to the Compliance_OU utilizing an allowlist pattern for specific services and regions, and requires local administrators to configure local IAM policies to grant actual permissions.
The correct option establishes organizational guardrails using Service Control Policies (SCPs) at the appropriate hierarchy levels (Root, Developer_OU, and Compliance_OU) while correctly recognizing that SCPs do not grant permissions directly. Local administrators must still create IAM policies to grant permissions to users and roles, adhering to the shared administration model in AWS Organizations.

Step-by-Step Solution

1
Analyze the AWS Config rule protection requirement.
Since AWS Config rules must be protected across all member accounts, a Service Control Policy (SCP) attached at the Organization Root is the most operationally efficient way to enforce this globally.
SCPs apply to all member accounts beneath the node where they are attached.
2
Evaluate how to prevent access to resources tagged as Confidentiality: High in the Developer_OU.
Apply an SCP to the Developer_OU that denies all actions on resources when the condition evaluates the tag Confidentiality: High.
This allows developers to create roles/policies locally but prevents those roles from accessing protected resources, overriding any local administrator permissions.
3
Evaluate the Compliance_OU restrictions on regions and services.
Apply an SCP to the Compliance_OU that denies any action if the region is not us-east-1 or us-west-2 (with global service exceptions), and denies actions for services other than EC2, RDS, DynamoDB, IAM, KMS, and CloudWatch.
This acts as a strict guardrail for both region and service usage.
4
Determine the relationship between SCPs and IAM policies.
Ensure local administrators configure local IAM policies to grant developers access to the approved services.
SCPs are authorization boundaries and do not grant permissions; access is only allowed when both the SCP and the local IAM policy permit it.

Key Concept

Understanding SCP inheritance, tag-based resource restriction, and integration with local IAM policies within AWS Organizations.
Rate this question

Topics

Multi-Account Governance and Organizational Structure

More questions from this topic