Examkin

Soru

Zorluk: OrtaMulti-Account Management and Governance

A financial services firm is establishing a landing zone to host transaction-processing workloads that must comply with PCI-DSS. The company has structured its AWS Organizations hierarchy with distinct Organizational Units (OUs) for Core, Workloads, and Sandbox. The architecture team needs to restrict root user activity in the member accounts, enforce multi-factor authentication (MFA) for administrative tasks, and implement a single sign-on experience linked to their corporate identity provider (IdP). Which combination of actions should the Solutions Architect take to establish this governance framework? (Select TWO.)

  1. Configure AWS IAM Identity Center and federate it with the corporate identity provider to manage user access across all member accounts.Cevap
  2. Apply an SCP to the Workloads and Sandbox OUs that denies API requests if the caller is the member account root user.Cevap
  3. C
    Create individual IAM users in the management account and configure cross-account roles to grant administrative access to member accounts.
  4. D
    Apply an SCP to the Organization root that restricts all permissions for the management account root user to prevent daily operations.
  5. E
    Establish VPC Peering connections between the management account and all member accounts to route administrative identity traffic through a central proxy server.

Cevap

Configure AWS IAM Identity Center federated with the corporate identity provider, and apply an SCP to the Workloads and Sandbox OUs that denies API requests if the caller is the member account root user.
Centralizing access through AWS IAM Identity Center federated with the corporate IdP allows seamless, secure single sign-on access across all member accounts without maintaining static credentials. In addition, applying an SCP to the Workloads and Sandbox OUs that denies all actions when the principal is the root user restricts member account root activities, which helps satisfy security standards like PCI-DSS.

Adım Adım Çözüm

1
Centralize administrative access management.
Enable and configure AWS IAM Identity Center, linking it with the corporate Identity Provider (IdP) via SAML 2.0 or OIDC.
This establishes a single sign-on (SSO) experience for administrators, eliminating the need to manage individual IAM users in each AWS account.
2
Restrict member account root user access.
Create a Service Control Policy (SCP) that explicitly denies all actions if the AWS Principal is the root user. Apply this SCP to the Workloads and Sandbox Organizational Units.
Applying this SCP ensures that nobody can perform administrative tasks using member account root credentials, enforcing the use of federated administrative identities instead.

Anahtar Kavram

Centralized multi-account governance involves federating administrative identities using AWS IAM Identity Center and enforcing policy guardrails with Service Control Policies (SCPs) in AWS Organizations.
Bu soruyu puanla

Konular

Multi-Account Management and Governance

Bu konudan daha fazla soru