Examkin

Soru

Zorluk: ZorMulti-Account Management and Governance

An enterprise is designing a secure multi-account environment to support multiple business units. The architecture must enforce centralized administrative control, federated access, and strict data protection policies. Specifically, the Solutions Architect must ensure that member accounts cannot delete Amazon S3 buckets containing centralized audit logs, and that employees authenticate using their corporate credentials to access designated AWS accounts.

Which combination of actions should the Solutions Architect recommend to achieve these goals? (Select TWO.)

  1. Configure AWS IAM Identity Center and integrate it with the enterprise identity provider to federate user access.Cevap
  2. Attach a service control policy (SCP) to the member account organizational units (OUs) that denies the s3:DeleteBucket and s3:DeleteObject actions on the centralized audit log buckets.Cevap
  3. C
    Create individual IAM users in each member account and configure cross-account roles with trust policies linked directly to the enterprise identity provider.
  4. D
    Apply a service control policy (SCP) at the Organization root level that restricts the management account root user from performing deletion actions on the log buckets.
  5. E
    Configure each member account's root user credentials to run a scheduled AWS Lambda function that periodically audits and restores deleted S3 log buckets.

Cevap

To establish secure multi-account governance, configure AWS IAM Identity Center integrated with the enterprise identity provider to federate user access, and apply a service control policy (SCP) to the member account organizational units (OUs) to deny bucket and object deletion actions on the centralized audit log buckets.
Centralizing access control through AWS IAM Identity Center integrated with the corporate identity provider ensures safe, federated access without the need for manual credential management. Applying a service control policy (SCP) to the member account OUs establishes a strong security guardrail, preventing anyone—including local administrators—from deleting critical audit log resources.

Adım Adım Çözüm

1
Set up centralized federation.
Connect AWS IAM Identity Center to the corporate identity provider (IdP).
Allows employees to authenticate using existing corporate credentials and access their assigned AWS accounts dynamically via role assumption, avoiding the creation of static, local IAM users.
2
Enforce data protection via Organizations.
Create a service control policy (SCP) with a Deny effect for s3:DeleteBucket and s3:DeleteObject actions targeting the audit log buckets, and attach it to the OUs containing the member accounts.
SCPs act as permission guardrails that override local administrator permissions in member accounts, ensuring that log deletion is blocked across all target accounts.

Anahtar Kavram

Multi-account governance through AWS Organizations service control policies (SCPs) and centralized identity federation using AWS IAM Identity Center.
Tahmini Süre:2m 30s
Bu soruyu puanla

Konular

Multi-Account Management and Governance

Bu konudan daha fazla soru