Examkin

Soru

Zorluk: ZorMulti-Account Governance and Organizational Structure

A medical diagnostics company is designing a multi-account architecture using AWS Organizations. The organization consists of a Management account, a Security Operations account, and a Production organizational unit (OU) containing multiple application member accounts.

The solutions architect must design a governance strategy to meet the following requirements:
1. Enable centralized management of AWS Security Hub and AWS Backup from the Security Operations account, ensuring that administrative operations can be performed without logging into the Management account.
2. Enforce that all Amazon EC2 instances and Amazon RDS DB instances launched within the Production OU are tagged with a valid 'CostCenter' key and value. Non-compliant resource creation must be blocked at API call time.
3. Ensure that an automated disaster recovery (DR) service, which runs under a cross-account IAM role named 'DR-Automation-Role' from a dedicated DR account, can still launch EC2 instances in the Production OU without being blocked by the tag enforcement.

Which combination of actions should the solutions architect take to meet these requirements with the least administrative overhead?

  1. A
    Configure AWS Security Hub and AWS Backup in the Management account. Create an IAM policy in each Production member account that allows tag-free creation specifically for the DR-Automation-Role, and apply an SCP to the Production OU that denies EC2 and RDS creation without the CostCenter tag. Rely on the local IAM policies to override the organizational SCP.
  2. B
    Register the Security Operations account as a Delegated Administrator. Use AWS Resource Access Manager (RAM) to share the DR-Automation-Role from the DR account with the Production OU. Apply an AWS Organizations tag policy to the Production OU with enforcement enabled, relying on AWS RAM to automatically exempt shared roles from tag policy validation.
  3. Register the Security Operations account as a Delegated Administrator for AWS Security Hub and AWS Backup. Apply an AWS Organizations tag policy at the root level to define the allowed values for the CostCenter tag. Apply a Service Control Policy (SCP) to the Production OU that denies ec2:RunInstances and rds:CreateDBInstance if the aws:RequestTag/CostCenter key is missing or invalid, using a condition that excludes the aws:PrincipalARN of the DR-Automation-Role.Cevap
  4. D
    Register the Security Operations account as a Delegated Administrator. Share the default AWS-managed KMS key for EBS (aws/ebs) from the DR account with the member accounts. Configure the SCP on the Production OU to deny resource creation unless encrypted by this shared key, assuming the DR role will automatically bypass tag enforcement through this KMS key sharing.

Cevap

Register the Security Operations account as a delegated administrator for AWS Security Hub and AWS Backup. Apply an AWS Organizations tag policy at the root to define allowed values, and apply an SCP to the Production OU that denies resource creation without the tag, exempting the cross-account DR role using a condition check on the principal ARN.
Centralizing management of AWS Security Hub and AWS Backup requires registering a delegated administrator account, which allows administration without using the Management account. While AWS Organizations tag policies define tag compliance rules, they do not actively block API requests to create resources; to enforce tagging at the API level, a Service Control Policy (SCP) with a Deny effect must be used. To allow the disaster recovery role to bypass this enforcement, the SCP must contain a condition checking the principal ARN (using 'aws:PrincipalARN') and exempting 'DR-Automation-Role' from the Deny rule. This configuration achieves the desired governance goals with minimal overhead.

Adım Adım Çözüm

1
Register Delegated Administrator from the Management account.
Centralizes administrative operations for AWS Security Hub and AWS Backup in the Security Operations account without needing Management account access.
Meets security and operational governance requirements to minimize root/management account usage.
2
Create and attach an AWS Organizations Tag Policy at the root level.
Defines the standardized capitalization and allowed values for the CostCenter tag across the entire organization.
Aligns resource classification compliance across OUs but does not actively enforce API blockages.
3
Create and attach a Service Control Policy (SCP) to the Production OU containing a Deny rule with a condition exclusion.
Prevents member account users from creating EC2 or RDS resources without the compliant CostCenter tag, while exempting requests originating from the DR-Automation-Role principal ARN.
Satisfies both tag enforcement and the requirement to allow automated disaster recovery replication activities without interruption.

Anahtar Kavram

Delegated administration and tag enforcement using Service Control Policies (SCPs) with principal-based exemptions in AWS Organizations.
Tahmini Süre:3m 0s
Bu soruyu puanla

Konular

Multi-Account Governance and Organizational Structure

Bu konudan daha fazla soru