Examkin

Soru

Zorluk: ZorMulti-Account Governance and Organizational Structure

A financial services company manages its multi-account environment using AWS Organizations. The architecture includes a Workloads Organizational Unit (OU) containing production and development accounts. The security team has deployed a cross-account IAM role named SecurityAuditRole in all member accounts to perform configuration audits.

The company has the following requirements:
1. Local administrators in the Workloads accounts (who possess administrator privileges) must be prevented from deleting or modifying the SecurityAuditRole.
2. All resources in the Workloads accounts must only be created in the us-east-1 and us-west-2 regions.
3. The SecurityAuditRole must be exempt from the regional restriction to allow it to scan for compliance violations in all AWS regions.

Which solution should a solutions architect implement to meet these requirements with the least administrative overhead?

  1. Attach a Service Control Policy (SCP) to the Workloads OU. In the first statement of the SCP, deny iam:* actions on the resource arn:aws:iam::*:role/SecurityAuditRole. In the second statement, deny all actions across all services if the aws:RequestedRegion condition key does not match us-east-1 or us-west-2, unless the aws:PrincipalARN matches arn:aws:iam::*:role/SecurityAuditRole. Ensure the default FullAWSAccess SCP remains attached to the OU, and keep existing local IAM policies in place.Cevap
  2. B
    Attach a Service Control Policy (SCP) to the Workloads OU that contains an Allow statement for all services in the us-east-1 and us-west-2 regions, and an Allow statement for the SecurityAuditRole in all regions. Detach the default FullAWSAccess SCP from the OU to enforce these parameters, and remove local IAM policies from the member accounts to ensure the SCP governs all operations.
  3. C
    Configure a SAML 2.0 trust relationship for the SecurityAuditRole in all member accounts but omit the sts:AssumeRole action from the trust policy to prevent local modifications. Apply an IAM permissions boundary to all local administrator roles that denies resource creation outside of us-east-1 and us-west-2 and denies modifications to the SecurityAuditRole. Do not use SCPs since they cannot inspect the principal ARN of cross-account roles.
  4. D
    Attach an SCP to the Workloads OU that denies all actions outside of us-east-1 and us-west-2. To enable the SecurityAuditRole to scan other regions, configure the central security account's AWS-managed KMS key (aws/s3) policy to grant cross-account decrypt permissions to the SecurityAuditRole in all member accounts, and configure local IAM policies to restrict administrators from modifying the audit role.

Cevap

Attach a Service Control Policy (SCP) to the Workloads OU that denies deletion and modification of the SecurityAuditRole, denies all regional actions outside us-east-1 and us-west-2 unless the caller is the SecurityAuditRole, and keeps both the default FullAWSAccess SCP and local IAM policies active.
The correct solution leverages Service Control Policies (SCPs) attached to the Workloads OU to enforce compliance boundaries. Because SCPs act as filters rather than direct grants, keeping the default FullAWSAccess SCP and local IAM policies is required to ensure users still have their granted permissions. An SCP with a Deny effect on iam:* actions for the SecurityAuditRole's ARN successfully prevents local administrators from deleting or modifying it. Additionally, combining a regional Deny on aws:RequestedRegion with a StringNotLike condition for aws:PrincipalARN allows the SecurityAuditRole to bypass regional limits and scan all regions globally.

Adım Adım Çözüm

1
Evaluate how to prevent local administrators in member accounts from deleting or modifying the audit role.
Identify that a Service Control Policy (SCP) attached to the Workloads OU can deny iam:* actions on the SecurityAuditRole resource, which applies even to administrators in the member accounts.
SCPs define the maximum permission boundaries for member accounts and cannot be overridden by local administrators.
2
Enforce regional constraints while exempting the SecurityAuditRole.
Create an SCP statement that denies actions if the aws:RequestedRegion is not us-east-1 or us-west-2, using a Condition block with StringNotLike for aws:PrincipalARN to exempt the SecurityAuditRole.
This ensures the audit role can query resources globally to check compliance, while blocking developers from launching resources in unapproved regions.
3
Determine the proper relationship between SCPs and local IAM policies.
Keep the default FullAWSAccess SCP attached to the OU and retain local IAM policies.
SCPs act as filters; they do not grant permissions. Detaching FullAWSAccess or removing local IAM policies would result in an implicit deny for all operations.

Anahtar Kavram

Multi-Account Governance using SCPs and IAM Policies
Tahmini Süre:3m 0s
Bu soruyu puanla

Konular

Multi-Account Governance and Organizational Structure

Bu konudan daha fazla soru