Examkin

Soru

Zorluk: OrtaMulti-Account Management and Governance

A retail enterprise is establishing a multi-account environment on AWS to support its online commerce platform. The solutions architect needs to set up a governance structure that achieves the following:
1. Enforces centralized user authentication mapped to the company's external corporate identity provider without provisioning static IAM users.
2. Ensures that development and testing accounts cannot launch resources in unauthorized AWS Regions.
3. Prevents member accounts from deleting or modifying Amazon S3 buckets that contain centralized security logs.

Which combination of actions will meet these requirements? (Select TWO.)

  1. Configure AWS IAM Identity Center to federate with the external corporate identity provider, mapping corporate groups to permission sets.Cevap
  2. Apply Service Control Policies (SCPs) to Organizational Units in AWS Organizations to deny resource creation in unauthorized Regions and protect log-archival Amazon S3 buckets.Cevap
  3. C
    Create individual IAM users in each member account with long-term credentials for each administrator and federate them individually.
  4. D
    Apply the restrictive Service Control Policies (SCPs) directly to the organization's management account to enforce global regional and bucket restrictions.
  5. E
    Configure Amazon Cognito user pools in the management account to manage corporate user identity federation and use IAM roles for cross-account access.

Cevap

Configure AWS IAM Identity Center to federate with the external corporate identity provider, mapping corporate groups to permission sets, and apply Service Control Policies (SCPs) to Organizational Units in AWS Organizations to deny resource creation in unauthorized Regions and protect log-archival Amazon S3 buckets.
Centralized authentication without static credentials is best achieved by integrating AWS IAM Identity Center with an external IdP. To enforce regional and resource-level constraints across member accounts, Service Control Policies (SCPs) must be applied at the Organizational Unit (OU) level, which ensures guardrails are inherited by the member accounts while keeping the management account clear of policy restrictions.

Adım Adım Çözüm

1
Set up identity federation using AWS IAM Identity Center.
Centralized authentication is mapped directly to the corporate identity provider groups without static local credentials.
Meets the requirement for centralized, credentials-free authentication.
2
Create and attach Service Control Policies (SCPs) to the relevant OUs.
Enforces regional restrictions and protects centralized S3 logging buckets across member accounts.
Enforces security guardrails at scale within the organization while ensuring they do not apply to the management account where admin flexibility is required.

Anahtar Kavram

Multi-Account Governance and Security Controls

Alternatif Yöntem

While AWS Control Tower landing zones could be deployed to establish these guardrails, configuring AWS IAM Identity Center and applying targeted SCPs via AWS Organizations represents the direct architectural mechanism to satisfy these specific compliance requirements.
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Multi-Account Management and Governance

Bu konudan daha fazla soru