A multinational corporation is designing its AWS multi-account governance strategy using AWS Organizations. The organizational structure has a Workloads Organizational Unit (OU) containing separate Production and Non-Production child OUs. The security team requires that AWS CloudTrail and AWS Config remain enabled and unaltered across all member accounts within the Workloads OU. Additionally, developers operating in these accounts must be prevented from deleting or modifying a centralized IAM role named SecurityComplianceRole. However, a central deployment pipeline that assumes an IAM role named PipelineExecutionRole in each member account must be permitted to modify these governance resources and update the SecurityComplianceRole during scheduled deployments. Which of the following governance strategies should a solutions architect recommend to meet these requirements with the least administrative effort?
- Apply a Service Control Policy (SCP) at the Workloads OU level that denies iam:* actions targeting the SecurityComplianceRole, and config:* and cloudtrail:* write actions. Add a Condition to the SCP that exempts the principal ARN of the PipelineExecutionRole from the Deny rule. Rely on local IAM policies in the member accounts to grant developers their necessary daily operational permissions.Cevap
- BApply a Service Control Policy (SCP) at the Workloads OU level that contains Allow statements permitting iam:* actions on the SecurityComplianceRole, and config:* and cloudtrail:* actions only for the PipelineExecutionRole. Rely on the SCP's Allow statements to automatically provision the necessary administrative permissions to developers in the member accounts without local IAM policies.
- CConfigure cross-account access by modifying the trust policy of the SecurityComplianceRole in each member account to trust the central pipeline. To simplify administration, omit the sts:AssumeRole action from the trust policy, and instead use local IAM group policies in the member accounts to grant the PipelineExecutionRole the authority to manage the SecurityComplianceRole.
- DConfigure CloudTrail and AWS Config in the member accounts to log to a centralized S3 bucket in the Security account. Enforce this via an SCP at the Workloads OU level, but use the default S3 bucket policy in the Security account, relying on the member accounts' inclusion in the AWS Organization to automatically inherit write permissions to the centralized bucket.