Examkin

Soru

Zorluk: KolayMulti-Account Governance and Organizational Structure

An organization needs to implement basic governance controls across its multi-account environment using AWS Organizations. The administrator wants to ensure that member accounts cannot disable AWS CloudTrail and cannot delete a centralized IAM role used for security auditing.

Which of the following actions should the administrator take to meet these requirements? (Select TWO.)

  1. Create a Service Control Policy (SCP) that denies the cloudtrail:StopLogging and cloudtrail:DeleteTrail actions, and attach it to the target organizational units (OUs).Cevap
  2. Create a Service Control Policy (SCP) that denies the iam:DeleteRole action for the auditing role, and attach it to the target organizational units (OUs).Cevap
  3. C
    Attach an IAM policy with a Deny effect on the target actions to the management account, relying on cross-account policy inheritance to protect member accounts.
  4. D
    Use AWS Resource Access Manager (RAM) to share the security auditing IAM role from the management account to all member accounts to restrict local deletion.
  5. E
    Create local Service Control Policies (SCPs) inside the IAM console of each individual member account to block the target actions.

Cevap

Create a Service Control Policy (SCP) that denies the cloudtrail:StopLogging and cloudtrail:DeleteTrail actions, and attach it to the target organizational units (OUs); and Create a Service Control Policy (SCP) that denies the iam:DeleteRole action for the auditing role, and attach it to the target organizational units (OUs).
To prevent member accounts from disabling AWS CloudTrail or deleting specific IAM roles, the organization must use Service Control Policies (SCPs) managed centrally. The option recommending an SCP denying the cloudtrail:StopLogging and cloudtrail:DeleteTrail actions, and the option recommending an SCP denying the iam:DeleteRole action for the auditing role are correct because SCPs define permission guardrails that restrict actions for all IAM users and roles in the member accounts, including the root user.

Adım Adım Çözüm

1
Identify the mechanisms available in AWS Organizations to enforce maximum permissions boundaries across multiple accounts.
Service Control Policies (SCPs) are identified as the primary tool to set guardrails and restrict actions for member accounts centrally.
SCPs allow centralized restriction of actions like disabling CloudTrail or deleting IAM roles across member accounts.
2
Determine the correct SCP configurations required for the requested restrictions.
An SCP denying cloudtrail:StopLogging/DeleteTrail and another denying iam:DeleteRole for the specific auditing role name are designed.
Explicit Deny statements in SCPs override any local administrator permissions in member accounts.
3
Evaluate the placement of these SCPs.
Attach the SCPs to the target organizational units (OUs) that contain the member accounts.
Attaching SCPs at the OU level ensures governance applies to all member accounts within those OUs.

Anahtar Kavram

Service Control Policies (SCPs) in AWS Organizations are used to establish permission guardrails across member accounts, overriding local administrators.
Bu soruyu puanla

Konular

Multi-Account Governance and Organizational Structure

Bu konudan daha fazla soru