Examkin

Soru

Zorluk: ZorMulti-Account Management and Governance

An enterprise is migrating its multi-account environment to AWS Organizations. The security team needs to enforce compliance by preventing any member account under the `Prod-Workloads` OU from deleting or modifying administrative IAM roles prefixed with `SecurityGov-`. Additionally, the enterprise requires centralized access management integrated with their Microsoft Entra ID identity provider. The solution must ensure that administrative tasks in member accounts do not require local IAM user credentials. Which strategy should a Solutions Architect implement to meet these requirements?

  1. Configure federated access using AWS IAM Identity Center integrated with Microsoft Entra ID. Attach an SCP to the `Prod-Workloads` OU that denies `iam:DeleteRole`, `iam:PutRolePolicy`, and `iam:AttachRolePolicy` actions for any resource prefixed with `SecurityGov-`, except when the principal is the IAM Identity Center administrative role.Cevap
  2. B
    Create individual IAM users in each member account under the `Prod-Workloads` OU to represent the enterprise directory users, configuring SAML federation for each user. Apply an SCP to the OU that denies all IAM role modifications for all principals.
  3. C
    Configure federated access using AWS IAM Identity Center integrated with Microsoft Entra ID. Attach an SCP to the organization's root to restrict the management account and all member accounts from modifying any IAM roles prefixed with `SecurityGov-`.
  4. D
    Configure Entra ID integration by enabling SAML federation with the management account. Use the management account's root credentials to perform administrative tasks in the member accounts, and attach an SCP to the `Prod-Workloads` OU to deny all local role updates.

Cevap

Configure federated access using AWS IAM Identity Center integrated with Microsoft Entra ID, and attach an SCP to the target OU denying modification of security roles with an exception for the admin role.
The correct strategy integrates Microsoft Entra ID with AWS IAM Identity Center for centralized access without requiring local IAM users. Using an SCP applied to the `Prod-Workloads` OU enforces the security guardrails on member accounts while exempting the admin role to allow legitimate updates to the security roles.

Adım Adım Çözüm

1
Analyze identity requirements
Determine that centralized federation using AWS IAM Identity Center is required to integrate with Microsoft Entra ID and avoid local credentials.
This simplifies credential management and aligns with AWS best practices for identity federation.
2
Analyze guardrail requirements
Establish that an SCP (Service Control Policy) attached to the `Prod-Workloads` OU is the correct mechanism to restrict role modification globally across the target member accounts.
SCPs enforce controls across accounts in an OU regardless of local administrator permissions.
3
Define SCP exceptions
Write the SCP to deny IAM modifications on the `SecurityGov-` role prefix, adding a condition that exempts the IAM Identity Center administrative role to allow legitimate changes.
A strict deny would block all users, including the central administrators, from managing the resources.

Anahtar Kavram

Centralized identity federation and multi-account guardrail enforcement using Service Control Policies (SCPs).
Bu soruyu puanla

Konular

Multi-Account Management and Governance

Bu konudan daha fazla soru