Examkin

Soru

Zorluk: OrtaMulti-Account Governance and Organizational Structure

A logistics company is designing its AWS Organizations multi-account structure. To enforce compliance, the security team requires that in all development member accounts:
1. Developers must not be able to delete any Amazon S3 buckets.
2. Developers must not be able to delete or modify the configuration of the centralized IT security roles (which are named with a 'SecurityAdmin-' prefix).
3. Developers must still be able to create and manage their own test S3 buckets and IAM roles for daily tasks.
The company uses AWS IAM Identity Center to federate developer access.
Which solution should a solutions architect implement to meet these requirements with the least operational overhead?

  1. A
    Create a Service Control Policy (SCP) that explicitly allows the 'iam:CreateRole' and 's3:CreateBucket' actions, and denies 's3:DeleteBucket' and any modifications to roles named with a 'SecurityAdmin-' prefix. Attach this SCP to the Development Organizational Unit (OU) and remove local IAM policies from the developers' IAM Identity Center permission sets.
  2. B
    Modify the trust relationship policy of the 'SecurityAdmin-' roles in each development account to deny all actions from developer IAM Identity Center roles. Attach a Service Control Policy (SCP) to the Development Organizational Unit (OU) that denies 's3:DeleteBucket' on all resources.
  3. Attach a Service Control Policy (SCP) to the Development Organizational Unit (OU) that denies the 's3:DeleteBucket' action on all resources, and denies IAM role modification and deletion actions if the resource path matches 'arn:aws:iam::*:role/SecurityAdmin-*'. Configure the developers' IAM Identity Center permission sets to allow S3 and IAM administrative actions.Cevap
  4. D
    Configure default encryption for S3 buckets in the development accounts using the AWS-managed key 'aws/s3'. Modify the policy of the 'aws/s3' key to deny 's3:DeleteBucket' permissions to developers. Use a Service Control Policy (SCP) attached to the Development Organizational Unit (OU) to deny modifications to roles starting with 'SecurityAdmin-'.

Cevap

The correct solution is to attach a Service Control Policy (SCP) to the Development Organizational Unit (OU) that denies bucket deletion globally and restricts modification of roles with the 'SecurityAdmin-' prefix, while using IAM Identity Center permission sets to grant developers active permissions to manage S3 and IAM.
The correct solution uses an SCP to restrict the deletion of S3 buckets and modification of specific IAM roles starting with 'SecurityAdmin-' across the member accounts in the Development OU. Because SCPs do not grant permissions, the developers' active permissions to create and manage their resources are assigned via IAM Identity Center permission sets.

Adım Adım Çözüm

1
Define a Service Control Policy (SCP) to centrally enforce security guardrails across the Organizational Unit (OU).
A policy is defined that denies 's3:DeleteBucket' on all resources and denies write actions on IAM roles matching 'arn:aws:iam::*:role/SecurityAdmin-*'.
SCPs are the most operationally efficient tool to restrict permissions across member accounts without managing policies in each account individually.
2
Associate the SCP with the Development OU.
The policy is inherited by all development member accounts in that OU.
This ensures consistent application of the guardrail to all current and future accounts under the OU.
3
Configure developer permissions in IAM Identity Center.
Permission sets allow developers to perform daily tasks like creating S3 buckets and managing non-security IAM roles.
SCPs do not grant permissions, so local IAM permissions must still be granted for the developers to perform their duties.

Anahtar Kavram

Multi-Account Governance using Service Control Policies (SCPs) and IAM Identity Center
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Multi-Account Governance and Organizational Structure

Bu konudan daha fazla soru