Examkin

Soru

Zorluk: ZorMulti-Account Governance and Organizational Structure

An enterprise manages its multi-account environment using AWS Organizations. The structure consists of a Management account, a Security organizational unit (OU) containing a Security Audit account, and several workload OUs containing production and development accounts. The security team designates the Security Audit account as the delegated administrator for Amazon GuardDuty and AWS Security Hub. The team requires that member accounts in the workload OUs must be prevented from disabling GuardDuty or Security Hub, and any new accounts created in or moved to these OUs must have these services enabled automatically. However, the Security Audit account must maintain the ability to configure, update, and disable these services across all member accounts for troubleshooting purposes. Which strategy meets these requirements with the least operational overhead?

  1. A
    Enable GuardDuty and Security Hub in each member account locally. Configure an IAM permission boundary in the Management account that denies modification of GuardDuty and Security Hub, and require all member accounts to apply this boundary to all local IAM users and roles. Manage these services by having the Security Audit account assume a cross-account IAM role in each member account.
  2. B
    Register the Security Audit account as the delegated administrator for GuardDuty and Security Hub from the Management account. Attach a Service Control Policy (SCP) to the Root OU that denies all guardduty:* and securityhub:* actions. In the workload accounts, configure local IAM policies to explicitly allow these actions only for roles assumed by the Security Audit account.
  3. Register the Security Audit account as the delegated administrator for GuardDuty and Security Hub from the Management account. Enable auto-enable for new accounts within GuardDuty and Security Hub from the Security Audit account. Attach a Service Control Policy (SCP) to the workload OUs that denies guardduty:DeleteDetector, guardduty:UpdateDetector, securityhub:DisableSecurityHub, and securityhub:UpdateStandardsControl, with a condition block that excludes the Security Audit account and the Management account using the aws:PrincipalAccount key.Cevap
  4. D
    Register the Security Audit account as the delegated administrator for GuardDuty and Security Hub from the Management account. Attach a Service Control Policy (SCP) to the workload OUs that denies guardduty:DeleteDetector, guardduty:UpdateDetector, securityhub:DisableSecurityHub, and securityhub:UpdateStandardsControl. Deploy a custom AWS Config rule and AWS Lambda function in the Security Audit account to automatically detect and remediate any unauthorized changes.

Cevap

Register the Security Audit account as the delegated administrator for GuardDuty and Security Hub from the Management account, enable auto-enable for new accounts from the Security Audit account, and attach an SCP to the workload OUs denying modifications to these services with a condition excluding the Security Audit and Management accounts using the aws:PrincipalAccount key.
Delegating administration to the Security Audit account enables central control, while enabling auto-enable ensures new accounts are immediately protected. The SCP attached to the workload OUs prevents local administrators from altering GuardDuty or Security Hub configurations. Crucially, the condition block using the aws:PrincipalAccount key ensures that the SCP restrictions do not apply to calls made by the Security Audit account or the Management account, allowing them to manage the services successfully.

Adım Adım Çözüm

1
Register the delegated administrator.
The Security Audit account is designated as the delegated administrator for Amazon GuardDuty and AWS Security Hub, allowing central management of these services across the organization.
This establishes centralized operations and satisfies the requirement that the Security Audit account maintains administrative control.
2
Configure auto-enable settings.
From the Security Audit account, enable the auto-enable configuration for GuardDuty and Security Hub for all current and future member accounts.
This automates security enablement for new accounts without manual intervention.
3
Create and attach the SCP with conditions.
Attach an SCP to the workload OUs that denies disable and update actions for GuardDuty and Security Hub, but includes a condition block checking that the calling principal's account ID does not match the Security Audit account or the Management account.
This acts as a preventive guardrail that stops local member account administrators from disabling the services while preserving the delegated administrator's ability to manage them.

Anahtar Kavram

Delegated administration and Service Control Policies (SCPs) with condition keys are used to enforce security compliance centrally while preserving administrative permissions for security teams.
Bu soruyu puanla

Konular

Multi-Account Governance and Organizational Structure

Bu konudan daha fazla soru