A Solutions Architect is designing a multi-account environment on AWS for a global retail analytics platform. The company wants to enforce a policy where database administrators can only manage database resources within specific production and development accounts. In addition, the security team requires that all user authentication be centralized against their existing external identity provider, and that security monitoring configurations in member accounts cannot be modified by any local administrators. Which combination of actions should the Solutions Architect recommend to meet these requirements with the least administrative effort?
- AConfigure an identity federation solution by creating individual IAM users with programmatic access in every AWS account, and write a custom synchronization script that maps corporate directory groups to local IAM group policies. Attach SCPs to the Organizational Units (OUs) to restrict security configuration modifications.
- BConfigure AWS IAM Identity Center for centralized federation. Create Service Control Policies (SCPs) that restrict security modifications, and apply them to the root of the organization to restrict both the management account and all member accounts. Perform all daily administrative tasks using the management account's root user credentials to ensure full compliance.
- Configure AWS IAM Identity Center connected to the external identity provider for user access. Create Service Control Policies (SCPs) in AWS Organizations that prevent the modification of security configurations, and attach them to the member Organizational Units (OUs).Cevap
- DCreate IAM users in a centralized security account and configure cross-account IAM roles in the member accounts. Instruct users to log in using their IAM user credentials and manually assume the appropriate roles. Apply local IAM policies with explicit deny statements in each member account to prevent security modifications.
Cevap
Configure AWS IAM Identity Center connected to the external identity provider for user access, and create Service Control Policies (SCPs) in AWS Organizations that prevent the modification of security configurations, attaching them to the member Organizational Units (OUs).
Centralizing authentication using AWS IAM Identity Center integrated with an external identity provider simplifies user access management without creating individual IAM users. Service Control Policies (SCPs) applied at the Organizational Unit (OU) level can restrict member accounts from modifying security configurations, implementing guardrails that even local administrators cannot bypass.
Adım Adım Çözüm
Anahtar Kavram
Multi-Account Governance with AWS Organizations, AWS IAM Identity Center, and Service Control Policies (SCPs)