Examkin

Soru

Zorluk: OrtaMulti-Account Management and Governance

A solutions architect is designing a multi-account environment using AWS Organizations for a company. The company requires that all employees authenticate using their existing corporate external identity provider (IdP) to access AWS resources. Additionally, the security team mandates that CloudTrail must be enabled in all member accounts, and no administrator in any member account should be able to disable it. Which combination of actions should the solutions architect take to meet these requirements? (Select TWO.)

  1. Configure AWS IAM Identity Center to federate with the external IdP and assign permission sets to manage user access across the member accounts.Cevap
  2. Implement a Service Control Policy (SCP) at the organization's root level that denies the cloudtrail:StopLogging action, and apply it to all member organizational units (OUs).Cevap
  3. C
    Create individual IAM users in the management account for each corporate employee, generate access keys, and configure cross-account roles to delegate access to member accounts.
  4. D
    Use the AWS Organizations management account root user credentials to configure local IAM users and deploy CloudTrail configurations across all member accounts.
  5. E
    Create an IAM role with administrator access in each member account and configure AD Connector in every member account to synchronize users directly to those roles.

Cevap

Configure AWS IAM Identity Center to federate with the external IdP and assign permission sets, and implement a Service Control Policy (SCP) at the organization's root level that denies the cloudtrail:StopLogging action.
The correct combination of actions leverages AWS IAM Identity Center for federated identity management and Service Control Policies (SCPs) for centralized account governance. Configuring AWS IAM Identity Center enables staff to log in using the external identity provider (IdP) with role-based access, while applying an SCP that denies the 'cloudtrail:StopLogging' action to the organizational units ensures that member account administrators cannot disable audit logging.

Adım Adım Çözüm

1
Address the authentication requirement by configuring identity federation.
AWS IAM Identity Center is connected to the corporate external Identity Provider (IdP), enabling single sign-on (SSO) and temporary credentials.
This centralizes authentication and avoids managing individual IAM users with long-term credentials.
2
Address the governance and auditing requirement by using AWS Organizations policies.
A Service Control Policy (SCP) is created in the management account that denies actions like cloudtrail:StopLogging and applied to member OUs.
This enforces organizational guardrails that cannot be overridden by administrators in member accounts.

Anahtar Kavram

AWS Organizations and AWS IAM Identity Center governance integration
Bu soruyu puanla

Konular

Multi-Account Management and Governance

Bu konudan daha fazla soru