Examkin

Soru

Zorluk: OrtaMulti-Account Governance and Organizational Structure

A logistics company is designing its multi-account governance strategy using AWS Organizations. The Security team must ensure that no member account in the Workloads Organizational Unit (OU) can disable or modify AWS Config configurations. Simultaneously, the Development team within the Workloads OU needs the ability to deploy and delete AWS CloudFormation templates that manage EC2 and RDS resources. What is the most operationally efficient way to implement these access controls?

  1. A
    Attach a Service Control Policy (SCP) to the Workloads OU that denies the config:Delete* and config:Stop* actions, and explicitly allows the cloudformation:*, ec2:*, and rds:* actions. Remove the default FullAWSAccess SCP from the Workloads OU.
  2. B
    Attach an IAM policy to the Organization Root that denies the config:Delete* and config:Stop* actions, and deploy local IAM policies in the member accounts to grant developers permissions to manage CloudFormation, EC2, and RDS.
  3. Attach a Service Control Policy (SCP) to the Workloads OU that denies the config:Delete* and config:Stop* actions. In the member accounts, configure local IAM policies that allow developers to manage AWS CloudFormation, EC2, and RDS resources.Cevap
  4. D
    Attach a Service Control Policy (SCP) to the Workloads OU that denies the config:Delete* and config:Stop* actions. Use AWS Resource Access Manager (RAM) to share developer IAM roles from the management account to the member accounts to grant the required permissions.

Cevap

Attach a Service Control Policy (SCP) to the Workloads OU that denies AWS Config modifications, and configure local IAM policies in the member accounts to allow developers to manage AWS CloudFormation, EC2, and RDS resources.
The correct solution uses an SCP to deny AWS Config modifications at the OU level, acting as a guardrail. Since SCPs only define the maximum permissions boundary and do not grant permissions, the default FullAWSAccess SCP is left in place, and developers are granted the required permissions using local IAM policies within their respective member accounts.

Adım Adım Çözüm

1
Identify the mechanism to enforce compliance guardrails across multiple AWS accounts.
Determine that Service Control Policies (SCPs) applied to the Workloads Organizational Unit (OU) are the correct tool to deny AWS Config changes.
SCPs allow administrators to centrally restrict services and actions for all accounts in an OU, overriding local administrator actions.
2
Determine how to grant developers permissions to deploy resources while staying within the SCP guardrails.
Create local IAM policies in the member accounts allowing access to CloudFormation, EC2, and RDS, while keeping the default FullAWSAccess SCP attached to the OU.
SCPs act as a filter rather than granting permissions. A local IAM policy is still required to explicitly allow the developer actions.

Anahtar Kavram

Service Control Policies (SCPs) establish permissions guardrails in an organization but do not grant permissions directly. Local IAM policies are required to authorize users to perform actions.
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Multi-Account Governance and Organizational Structure

Bu konudan daha fazla soru