Examkin

Soru

Zorluk: OrtaMulti-Account Governance and Organizational Structure

A logistics firm is organizing its cloud footprint using AWS Organizations. The security team requires that all member accounts under the Dev-Sandbox Organizational Unit (OU) be blocked from launching Amazon Redshift clusters to control costs. However, developers in these sandbox accounts must retain full administrative privileges for all other AWS services to test new features. The solution must be managed centrally and minimize administrative overhead. Which strategy should a solutions architect recommend to meet these requirements with the least operational overhead?

  1. A
    Configure AWS Resource Access Manager (RAM) to share a centralized IAM permission boundary that restricts Redshift access to all member accounts in the Dev-Sandbox OU.
  2. Attach a Service Control Policy (SCP) to the Dev-Sandbox OU containing a Deny rule for the redshift actions, while keeping the local IAM policies in the member accounts unchanged.Cevap
  3. C
    Attach a Service Control Policy (SCP) to the Dev-Sandbox OU containing an Allow rule for all services except Redshift, and remove the local IAM policies in the member accounts.
  4. D
    Create an IAM policy that denies redshift actions in a centralized account, and configure AWS Directory Service to federate and map this policy to all local user roles.

Cevap

Attach a Service Control Policy (SCP) to the Dev-Sandbox OU containing a Deny rule for the redshift actions, while keeping the local IAM policies in the member accounts unchanged.
Attaching a Service Control Policy (SCP) with a Deny statement directly to the target Organizational Unit (OU) is the most operationally efficient strategy. Explicit Deny statements in SCPs override any local permissions (including local administrator access) without requiring manual changes to existing IAM policies, users, or roles in the member accounts.

Adım Adım Çözüm

1
Analyze the requirement to restrict access to a specific AWS service centrally across multiple accounts under a specific OU.
Identified that AWS Organizations Service Control Policies (SCPs) are designed for centralized permission guardrails.
SCPs apply to OUs or accounts and filter the maximum permissions that can be exercised within those scopes.
2
Determine the impact of SCPs on existing administrator permissions in member accounts.
An explicit Deny rule in an SCP overrides any local Allow rules, including local AdministratorAccess permissions, without needing to modify the local IAM configurations.
In AWS IAM and Organizations evaluation logic, an explicit Deny always supersedes any Allow.
3
Review the alternative options for compliance and operational efficiency.
Eliminated options attempting to share policies via AWS RAM, manage local federation role mappings, or grant permissions solely via SCPs due to technical limitations and operational overhead.
Ensures the selected approach leverages native, supported, and low-overhead AWS mechanisms.

Anahtar Kavram

Service Control Policies (SCPs) define the maximum available permissions for member accounts in an AWS Organization, allowing central administrators to establish guardrails that cannot be bypassed by local account administrators.
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Multi-Account Governance and Organizational Structure

Bu konudan daha fazla soru