Examkin

Soru

Zorluk: OrtaMulti-Account Governance and Organizational Structure

A financial services company manages its multi-account environment using AWS Organizations. To ensure strict compliance, the security team wants to restrict member accounts in the Development Organizational Unit (OU) to only use Amazon S3, Amazon EC2, and Amazon DynamoDB. A solutions architect creates a custom Service Control Policy (SCP) that allows all actions (`*`) for `s3`, `ec2`, and `dynamodb`. The architect attaches this SCP to the Development OU and removes the default `FullAWSAccess` SCP. Shortly after, a developer in a development member account attempts to upload objects to an S3 bucket. The S3 bucket is encrypted with a Customer Managed Key (CMK) stored in the same account. The developer's IAM role has the AWS-managed policy `AmazonS3FullAccess` attached. However, the developer receives an 'Access Denied' error. What is the root cause of this issue?

  1. A
    The custom SCP on the OU automatically overrides the developer's local IAM policies and grants S3 access directly, but the developer must use an IAM role in the Organizations management account to inherit the SCP permissions.
  2. B
    The S3 bucket is encrypted using an AWS-managed KMS key (aws/s3), which does not support policy modifications, and the developer must modify the key policy of the AWS-managed KMS key to allow the member account's role access.
  3. C
    The developer's IAM role is missing a trust relationship with the AWS Organizations management account, which prevents the role from inheriting permissions from the newly attached Service Control Policy.
  4. The custom SCP implicitly denies AWS KMS actions because the default FullAWSAccess SCP was removed. The developer's IAM role lacks permission to use the Customer Managed Key (CMK) for encryption because the SCP blocks the required Key Management Service (KMS) actions.Cevap

Cevap

The custom SCP implicitly denies AWS KMS actions because the default FullAWSAccess SCP was removed. The developer's IAM role lacks permission to use the Customer Managed Key (CMK) for encryption because the SCP blocks the required Key Management Service (KMS) actions.
The correct answer is correct because SCPs in AWS Organizations act as filters that define the maximum permissions for member accounts. By default, the FullAWSAccess SCP allows all actions. When it is removed and replaced by a custom SCP that only allows S3, EC2, and DynamoDB, any other service (such as KMS) is implicitly denied. Since the S3 bucket is encrypted with a Customer Managed Key (CMK), writing to it requires KMS actions (kms:GenerateDataKey and kms:Decrypt). The implicit deny in the SCP blocks these KMS actions, causing the upload operation to fail despite the developer's local S3 permissions.

Adım Adım Çözüm

1
Analyze how SCPs function in AWS Organizations when the default FullAWSAccess SCP is removed.
Removing the default FullAWSAccess SCP means that any AWS service or API action not explicitly allowed in the remaining attached SCPs is implicitly denied.
This establishes the baseline that only services explicitly whitelisted in the custom SCP can be accessed by users in the member accounts.
2
Identify the encryption requirement for writing objects to the S3 bucket.
The S3 bucket is encrypted using a Customer Managed Key (CMK) in AWS Key Management Service (KMS). Writing to this bucket requires both S3 permissions and KMS permissions (kms:GenerateDataKey, kms:Decrypt).
This shows that the client needs permission to interact with AWS KMS to perform the S3 upload operation successfully.
3
Determine the interaction between the custom SCP and the developer's IAM role.
The custom SCP allows S3, EC2, and DynamoDB, but does not allow KMS. Therefore, KMS actions are implicitly denied at the organization boundary. This deny overrides the local IAM policy's allow permissions.
This explains why the developer receives an Access Denied error despite having the AmazonS3FullAccess local policy.

Anahtar Kavram

Service Control Policies (SCPs) define the maximum permission boundaries in an AWS Organization. Removing the default FullAWSAccess SCP and attaching a custom SCP that restricts allowed services will implicitly deny access to any unlisted dependent services (like AWS KMS), even if users have local administrative privileges.
Bu soruyu puanla

Konular

Multi-Account Governance and Organizational Structure

Bu konudan daha fazla soru