Examkin

Soru

Zorluk: ZorMulti-Account Management and Governance

A genomic research organization is establishing a multi-account environment on AWS using AWS Control Tower to isolate clinical datasets. The organization wants to federate user access using their existing on-premises Active Directory identity provider. Additionally, the security policy mandates that no long-term credentials (such as access keys) can be generated for IAM users in any member account, and standard daily administration must not utilize root user credentials.

Which combination of actions will meet these requirements while maintaining centralized governance? (Select TWO.)

  1. Configure AWS IAM Identity Center and connect it to the on-premises Active Directory using an Active Directory Connector to manage user access across the AWS accounts.Cevap
  2. Apply a Service Control Policy (SCP) at the Organizational Unit (OU) level that denies iam:CreateUser and iam:CreateAccessKey API calls.Cevap
  3. C
    Create individual IAM users in each member account corresponding to Active Directory users and distribute long-term AWS access keys for federated access.
  4. D
    Configure the root user of each member account to run standard administrative tasks, securing the accounts by rotating the root password daily using a custom AWS Lambda function.
  5. E
    Use the root credentials of the management account to create local IAM users with root privileges in each member account for standard administration.

Cevap

Configure AWS IAM Identity Center connected to the on-premises Active Directory via an Active Directory Connector, and apply a Service Control Policy (SCP) at the Organizational Unit (OU) level that denies user and access key creation.
The correct combination involves integrating AWS IAM Identity Center with the on-premises Active Directory using an Active Directory Connector, which provides single sign-on access with short-term credentials. Concurrently, a Service Control Policy (SCP) applied at the Organizational Unit level centrally denies the creation of new IAM users and long-term access keys, ensuring strict compliance across all member accounts.

Adım Adım Çözüm

1
Evaluate the federation requirement.
Identify that AWS IAM Identity Center can integrate with an on-premises Active Directory (using AD Connector) to manage identity federation centralized, avoiding local IAM users.
This meets the federation objective without manual local credential management.
2
Evaluate the policy to prevent long-term IAM credential generation.
Formulate a Service Control Policy (SCP) that denies iam:CreateUser and iam:CreateAccessKey API actions.
Applying this SCP at the OU level prevents users and administrators in member accounts from creating static credentials.
3
Ensure root credentials are not used for standard operations.
Rely on AWS IAM Identity Center permission sets mapped to federated roles for daily administrative work instead of logging into root accounts.
This aligns with the AWS well-architected framework for multi-account access governance.

Anahtar Kavram

Multi-Account Security Governance and Identity Federation
Bu soruyu puanla

Konular

Multi-Account Management and Governance

Bu konudan daha fazla soru