Examkin

Soru

Zorluk: OrtaMulti-Account Governance and Organizational Structure

An enterprise manages its multi-account environment using AWS Organizations. The organizational structure consists of a parent Organizational Unit (OU) named 'Operations' and a nested child OU named 'Production' under it. A solutions architect attaches a Service Control Policy (SCP) to the 'Operations' OU that allows only EC2 and CloudWatch actions (ec2:* and cloudwatch:*). To ensure that production applications can access storage, the solutions architect attaches another SCP to the 'Production' OU that allows EC2, CloudWatch, and S3 actions (ec2:*, cloudwatch:*, and s3:*). The local IAM policies in the member accounts under the 'Production' OU grant full administrator access (*:*). When a developer in a 'Production' member account attempts to list S3 buckets using the local administrator credentials, the request is denied. Which of the following is the primary reason the developer's request is denied?

  1. The Service Control Policy (SCP) at the parent 'Operations' OU does not allow S3 actions. In an AWS Organizations hierarchy, permissions must be explicitly allowed at every level of the path from the root to the member account, meaning the parent OU's restriction filters out S3 access before it reaches the child OU.Cevap
  2. B
    The SCP attached to the child 'Production' OU does not automatically delegate S3 permissions to local IAM users because SCPs only apply to the root user of member accounts by default, requiring an explicit principal definition in the SCP to affect other IAM identities.
  3. C
    The local administrator credentials belong to a federated role that is missing a trust relationship with the organization's management account, preventing the security token service from evaluating nested SCP permissions.
  4. D
    The S3 buckets are encrypted using AWS-managed KMS keys, which cannot be accessed by roles in nested member accounts when any parent OU restricts access to standard AWS services.

Cevap

The Service Control Policy (SCP) at the parent 'Operations' OU does not allow S3 actions, and because permissions must be allowed at every level of the path from the root to the member account, the restriction filters out S3 access before it reaches the child OU.
The correct answer is correct because AWS Organizations evaluates Service Control Policies (SCPs) hierarchically from the root down to the member account. For any action to be authorized in a member account, it must be allowed by the SCPs at every single level of the hierarchy path. Because the parent 'Operations' OU only allows EC2 and CloudWatch, S3 access is filtered out at that level, preventing the child 'Production' OU from granting or inheriting S3 permissions even if its own SCP and local IAM policies allow it.

Adım Adım Çözüm

1
Analyze the AWS Organizations hierarchy path.
The path is Root -> Operations OU (Parent) -> Production OU (Child) -> Member Account.
This establishes the chain of evaluation for Service Control Policies (SCPs).
2
Evaluate the SCP permissions allowed at each level.
Root allows all permissions. Operations OU allows only ec2:* and cloudwatch:*. Production OU allows ec2:*, cloudwatch:*, and s3:*.
Each level's SCP defines the maximum allowable permissions for all accounts below it.
3
Apply the hierarchical evaluation rule of AWS Organizations.
The intersection of permissions at all levels is allowed. S3 is not allowed at the Operations OU level, so the intersection for S3 is empty.
For a permission to be allowed, it must be explicitly allowed at every level from the root to the target account.

Anahtar Kavram

Service Control Policy (SCP) evaluation in nested Organizational Units (OUs)
Bu soruyu puanla

Konular

Multi-Account Governance and Organizational Structure

Bu konudan daha fazla soru