Examkin

Soru

Zorluk: ZorMulti-Account Governance and Organizational Structure

A global enterprise uses AWS Organizations to manage its multi-account environment. The security team wants to establish a governance framework for the 'Product-Teams' Organizational Unit (OU). The framework must ensure that developers can only provision AWS resources, such as Amazon EC2 instances and Amazon RDS databases, using pre-approved templates defined in AWS Service Catalog. Direct resource provisioning via the AWS Management Console or AWS CLI must be blocked. The underlying CloudFormation templates are stored in a central Amazon S3 bucket in a shared services account and must be encrypted at rest. The solution must minimize administrative overhead and avoid managing local IAM policies in each member account to restrict resource creation. Which solution meets these requirements?

  1. Register a delegated administrator account for AWS Service Catalog. Create the portfolios in this account and share them with the 'Product-Teams' OU using AWS Organizations sharing. Store the templates in an S3 bucket encrypted with an AWS KMS Customer Managed Key (CMK), and grant the member accounts access to the CMK. Apply a Service Control Policy (SCP) to the OU that denies direct resource creation actions unless the 'aws:CalledVia' condition key contains 'cloudformation.amazonaws.com'.Cevap
  2. B
    Register a delegated administrator account for AWS Service Catalog. Create the portfolios in this account and share them with the 'Product-Teams' OU. Apply a Service Control Policy (SCP) to the OU that denies all resource creation actions, and configure local IAM policies on developer roles in the member accounts with an 'Allow' effect for Service Catalog to override the SCP's restriction.
  3. C
    Register a delegated administrator account for AWS Service Catalog. Create the portfolios in this account and share them with the 'Product-Teams' OU. Store the templates in an S3 bucket encrypted with the default AWS-managed KMS key 'aws/s3'. Apply a Service Control Policy (SCP) to the OU that denies direct resource creation actions unless the 'aws:CalledVia' condition key contains 'cloudformation.amazonaws.com'.
  4. D
    Register a delegated administrator account for AWS Service Catalog. Use AWS Resource Access Manager (RAM) to share the portfolios with the 'Product-Teams' OU. Store the templates in an S3 bucket encrypted with an AWS KMS Customer Managed Key (CMK), and grant the member accounts access to the CMK. Apply a Service Control Policy (SCP) to the OU that denies direct resource creation actions.

Cevap

Register a delegated administrator account for AWS Service Catalog, share portfolios via AWS Organizations sharing, encrypt the templates using a KMS Customer Managed Key (CMK) with cross-account access enabled, and apply an SCP denying direct resource creation unless called via CloudFormation.
Centralizing Service Catalog portfolios under a delegated administrator account and sharing them using AWS Organizations provides a scalable distribution model. Because AWS-managed KMS keys cannot be shared with other accounts, encrypting templates with a Customer Managed Key (CMK) and granting the member accounts access is required for cross-account deployments. Using an SCP with the 'aws:CalledVia' condition key containing 'cloudformation.amazonaws.com' ensures that direct resource creation is blocked while allowing the Service Catalog (which relies on CloudFormation) to successfully provision the resources.

Adım Adım Çözüm

1
Configure AWS Service Catalog portfolio sharing across the organization.
A delegated administrator account is registered, and portfolios are shared with the 'Product-Teams' OU, allowing automatic propagation of approved templates.
This provides centralized template management and minimizes administrative overhead.
2
Configure template encryption and key policies for cross-account access.
Templates in the S3 bucket are encrypted with a Customer Managed Key (CMK), and the key policy allows member accounts to use the key.
AWS-managed KMS keys cannot be shared or used for cross-account decryption by the member accounts.
3
Create and apply a Service Control Policy (SCP) to the OU with an aws:CalledVia condition key.
Direct API calls to create resources are blocked, but calls made via CloudFormation (triggered by Service Catalog) are permitted.
This acts as a centralized guardrail enforcing the use of Service Catalog without requiring individual IAM policy updates in each member account.

Anahtar Kavram

Centralized multi-account governance using AWS Service Catalog, SCPs with CalledVia conditions, and cross-account Customer Managed Keys.
Bu soruyu puanla

Konular

Multi-Account Governance and Organizational Structure

Bu konudan daha fazla soru