Examkin

Soru

Zorluk: Çok zorMulti-Account Management and Governance

A Solutions Architect is designing the multi-account governance and security framework for an enterprise using AWS Organizations. The organization consists of separate Organizational Units (OUs) for Core Services, Production Workloads, and Development Sandboxes. The compliance team requires that no member account be able to modify or delete centralized AWS CloudTrail and AWS Config configurations. Additionally, corporate users must authenticate using an external SAML 2.0 identity provider to access target member accounts using temporary credentials, minimizing administrative overhead in individual accounts. Finally, these controls must not restrict management functions or billing administrative tasks in the management account. Which two actions should the Solutions Architect take to meet these requirements? (Select TWO.)

  1. Configure AWS IAM Identity Center to federate with the external identity provider using SAML 2.0, and assign permission sets to manage access across member accounts.Cevap
  2. Create an SCP that denies the ability to delete or modify AWS CloudTrail and AWS Config resources, and attach it to the organization's root or specific OUs.Cevap
  3. C
    Apply an SCP directly to the management account to restrict administrative users and prevent them from deleting or disabling auditing resources.
  4. D
    Create IAM users in the organization's management account for each corporate user, and configure cross-account IAM roles in the member accounts to enable federated access.
  5. E
    Generate long-term IAM access keys for each corporate user in a centralized security account, and configure the external identity provider to pass these keys during federation.

Cevap

Configure AWS IAM Identity Center to federate with the external identity provider using SAML 2.0, and assign permission sets to manage access across member accounts. Create an SCP that denies the ability to delete or modify AWS CloudTrail and AWS Config resources, and attach it to the organization's root or specific OUs.
Centralizing identity access via AWS IAM Identity Center allows integration with an external SAML 2.0 identity provider to manage users and permission sets centrally, providing short-term credentials without creating IAM users in every account. Additionally, Service Control Policies (SCPs) applied at the organization's root or OUs prevent member accounts from modifying auditing resources, while leaving the management account unaffected because SCPs do not apply to it.

Adım Adım Çözüm

1
Identify the mechanism for centralized identity federation.
AWS IAM Identity Center is selected to federate with the SAML 2.0 identity provider, enabling single sign-on with short-term credentials across member accounts.
This avoids manual IAM user creation and complies with security best practices.
2
Determine the control policy type for compliance enforcement across member accounts.
An SCP is designed to deny deletion or modification of AWS CloudTrail and AWS Config.
SCPs allow global permission boundaries to be enforced across all member accounts within an OU or the entire organization.
3
Evaluate the impact on the management account.
The SCP is attached to the organization's root or specific OUs. Since SCPs do not apply to the management account, the management account's administrative and billing functions remain unrestricted.
This satisfies the requirement that governance controls do not disrupt the management account's functions.

Anahtar Kavram

Centralized governance via AWS Organizations SCPs and identity federation via AWS IAM Identity Center.
Bu soruyu puanla

Konular

Multi-Account Management and Governance

Bu konudan daha fazla soru