A company is setting up a new multi-account AWS environment using AWS Organizations. The company wants to implement centralized user authentication that integrates with their existing corporate identity provider. Additionally, they need to enforce a security policy that prevents any administrator in the member accounts from deleting Amazon S3 buckets that store access logs.
Which combination of AWS services or features will meet these requirements? (Select TWO.)
- AWS IAM Identity Center federated with the corporate identity provider for centralized user accessCevap
- Service Control Policies (SCPs) in AWS Organizations to deny the deletion of the log buckets across member accountsCevap
- CIndividual IAM users created in each member account with configured federation settings for each employee
- DAn IAM policy attached to the root user of each member account that restricts access to the log buckets
- EThe AWS account root user credentials of the management account used to perform daily log auditing tasks
Cevap
Configure AWS IAM Identity Center federated with the corporate identity provider for centralized user access, and apply Service Control Policies (SCPs) in AWS Organizations to deny the deletion of the log buckets across member accounts.
Centralized user access across multiple AWS accounts should be implemented using AWS IAM Identity Center federated with the external identity provider. To enforce administrative compliance and prevent critical resource deletion (such as S3 access log buckets) across member accounts, Service Control Policies (SCPs) must be attached to the appropriate Organizational Units (OUs) or accounts in AWS Organizations.
Adım Adım Çözüm
Anahtar Kavram
Centralized multi-account governance is achieved by combining federated access management via AWS IAM Identity Center with Organization-level guardrails using Service Control Policies (SCPs).