Examkin

Soru

Zorluk: OrtaIdentity and Access Management (IAM)

A company is establishing a multi-account environment using AWS Organizations. The security team wants to delegate the ability to create IAM roles to the development team lead in a member account. However, the security team must ensure that the team lead cannot create roles that grant permissions exceeding a defined threshold. Furthermore, compliance rules dictate that no entity within the member account—including the AWS account root user—should be able to stop or delete AWS CloudTrail logging. Which TWO options should the solutions architect choose to meet these requirements?

  1. Apply a Service Control Policy (SCP) at the member account level in AWS Organizations that denies the cloudtrail:StopLogging and cloudtrail:DeleteTrail actions.Cevap
  2. Configure an IAM permissions boundary that defines the maximum permitted actions, and attach an IAM policy to the team lead that allows role creation only if the permissions boundary is applied.Cevap
  3. C
    Use the AWS account root user credentials to create all daily resources and apply an IAM identity-based policy to the root user to prevent disabling CloudTrail.
  4. D
    Create individual IAM users for each developer in the organization's management account and generate long-term access keys for them to assume administrative roles.
  5. E
    Store a backup administrator's access key and secret access key as a plaintext String parameter in AWS Systems Manager Parameter Store for easy retrieval by the team lead.

Cevap

The solutions architect should apply a Service Control Policy (SCP) to deny CloudTrail logging modifications and configure an IAM permissions boundary to restrict the maximum permissions of roles created by the team lead.
Applying a Service Control Policy (SCP) to the member account is the only way to enforce restrictions (such as denying changes to CloudTrail) on all users and roles, including the member account's root user. Creating an IAM permissions boundary and requiring it during role creation ensures that the development team lead can create roles for developers without granting permissions that exceed the security team's defined boundary.

Adım Adım Çözüm

1
Restricting CloudTrail modification across all users including root.
Apply an AWS Organizations Service Control Policy (SCP) denying cloudtrail:StopLogging and cloudtrail:DeleteTrail.
SCPs apply to all accounts in the Organization and affect all principals in member accounts, including the AWS account root user, which cannot be restricted by standard IAM policies.
2
Delegating role creation with a boundary.
Use an IAM permissions boundary defining the maximum allowed permissions.
Requiring a permissions boundary during role creation prevents delegated administrators from creating roles with privilege escalation capabilities.
3
Eliminating options with insecure patterns.
Reject options that propose using root credentials, creating management account IAM users, or storing access keys in plaintext.
These violate AWS security best practices regarding root account protection, federation, and secrets management.

Anahtar Kavram

Delegating IAM administration with permissions boundaries and enforcing organization-wide guardrails using SCPs.
Bu soruyu puanla

Konular

Identity and Access Management (IAM)

Bu konudan daha fazla soru