Examkin

Soru

Zorluk: OrtaMulti-Account Governance and Organizational Structure

A financial services company is establishing governance controls across its AWS multi-account environment managed by AWS Organizations. The organization contains a Production OU and a Development OU. The security team mandates the following requirements:

* Developers in the Development OU must only be allowed to deploy resources in the `us-east-1` and `us-west-2` Regions.
* No user or IAM role within any member account, including administrators, should be able to disable or modify AWS CloudTrail logging configuration.
* The Organization's management account must remain unaffected by these restrictions to allow global operations.

Which of the following governance actions will meet these requirements? (Select TWO.)

  1. Create a Service Control Policy (SCP) that denies all actions if the `aws:RequestedRegion` condition is not `us-east-1` or `us-west-2`, and attach it to the Development OU.Cevap
  2. Create a Service Control Policy (SCP) that denies the `cloudtrail:StopLogging`, `cloudtrail:UpdateTrail`, and `cloudtrail:DeleteTrail` actions, and attach it to the organization's Root.Cevap
  3. C
    Create an IAM permission boundary in the management account, and use AWS Resource Access Manager (RAM) to share and enforce it across all administrator roles in the member accounts.
  4. D
    Attach a Service Control Policy (SCP) directly to the organization's management account that denies region access and CloudTrail modifications, relying on organizational inheritance.
  5. E
    Configure an IAM role in each member account with a policy that denies CloudTrail modifications and regional access, as local IAM policies always override SCPs.

Cevap

The correct strategy involves creating a Service Control Policy (SCP) that denies actions outside the specified regions and attaching it to the Development OU, and creating another SCP that denies CloudTrail modification actions and attaching it to the organization's Root.
To satisfy the requirements, the Solutions Architect should attach an SCP restricting regions to the Development OU and attach an SCP restricting CloudTrail modifications to the Root. Service Control Policies (SCPs) define the maximum permissions for member accounts. Because SCPs do not apply to the organization's management account, attaching the CloudTrail restriction at the Root will secure member accounts while keeping the management account unaffected.

Adım Adım Çözüm

1
Analyze regional restriction requirements.
Create an SCP using the `aws:RequestedRegion` condition key to restrict operations to `us-east-1` and `us-west-2` and attach it to the Development OU.
SCPs applied to OUs restrict all accounts and users (including root/administrators) under that OU, which is ideal for isolating development account permissions.
2
Analyze CloudTrail protection requirements.
Create an SCP denying `cloudtrail:StopLogging`, `cloudtrail:UpdateTrail`, and `cloudtrail:DeleteTrail` and attach it to the Root.
Attaching the policy to the organization's Root ensures the policy is inherited by all member accounts under the organization, protecting CloudTrail settings globally.
3
Evaluate the management account exemption requirement.
Confirm that the management account is unaffected by the Root-level SCP.
By design, AWS Organizations Service Control Policies (SCPs) do not apply to the organization's management account, fulfilling the requirement without needing explicit exclusion logic.

Anahtar Kavram

AWS Organizations Multi-Account Governance with Service Control Policies (SCPs)
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Multi-Account Governance and Organizational Structure

Bu konudan daha fazla soru