A company is setting up its multi-account structure in AWS Organizations. They have created a dedicated 'Security' Organizational Unit (OU) containing several member accounts. The security team wants to ensure that no IAM user or role within the member accounts, including the root user, can delete or disable AWS Config rules that are deployed for compliance monitoring. Which mechanism should the solutions architect use to enforce this restriction across the Organizational Unit (OU)?
- Apply a Service Control Policy (SCP) with a Deny effect on AWS Config API actions at the Organizational Unit (OU) level.Cevap
- BAttach a Service Control Policy (SCP) to the Organizational Unit (OU) that explicitly grants Allow permissions for AWS Config actions to replace local IAM policies.
- CConfigure an Amazon S3 bucket policy in a centralized security account to restrict all write and delete operations for the Config configuration recorder files.
- DDeploy an AWS KMS customer managed key to encrypt Config data and use the key policy to block all decryption requests from the member accounts.
Cevap
Apply a Service Control Policy (SCP) with a Deny effect on AWS Config API actions at the Organizational Unit (OU) level.
Applying a Service Control Policy (SCP) with a Deny effect at the Organizational Unit (OU) level enforces permission boundaries across all member accounts within that OU, including the root user. This prevents any IAM identity in those accounts from deleting or modifying AWS Config rules.
Adım Adım Çözüm
Anahtar Kavram
AWS Organizations Service Control Policies (SCPs) act as permission guardrails that restrict maximum available permissions in member accounts, overriding local administrators.