Examkin

Soru

Zorluk: ZorMulti-Account Governance and Organizational Structure

An enterprise software provider is structuring its multi-account environment using AWS Organizations. The architecture consists of a Core Organizational Unit (OU) for shared services and a Deployments OU for application workloads. The security team must implement a governance strategy with the following requirements:

* Production and staging member accounts in the Deployments OU must be prevented from using any AWS services other than Amazon EC2, Amazon S3, and Amazon DynamoDB.
* A centrally managed IAM role named PlatformSecurityAuditor must be able to run configuration checks and access all AWS services across all member accounts in the Deployments OU.
* Member accounts must be strictly prevented from leaving the AWS Organization.

Which combination of actions should the Solutions Architect take to meet these requirements? (Select TWO.)

  1. Apply a Service Control Policy (SCP) to the Deployments OU that blocks the organizations:LeaveOrganization action.Cevap
  2. Apply a Service Control Policy (SCP) to the Deployments OU with a Deny effect, a NotAction block listing the approved services along with necessary IAM and STS actions, and a condition key of ArnNotEquals for aws:PrincipalARN that specifies the PlatformSecurityAuditor role ARN.Cevap
  3. C
    Apply a Service Control Policy (SCP) to the Deployments OU with an Allow effect that lists only the approved services, and rely on IAM policies in the member accounts to grant the PlatformSecurityAuditor role access to all services.
  4. D
    Create an IAM permissions boundary in each member account that restricts access to the approved services, and apply this boundary to all IAM identities, including the account root user, while exempting the PlatformSecurityAuditor role.
  5. E
    Apply a Service Control Policy (SCP) to the Deployments OU that denies the organizations:RemoveAccountFromOrganization action, and create an IAM policy for the PlatformSecurityAuditor role that permits all actions.

Cevap

Apply a Service Control Policy (SCP) to the Deployments OU that blocks the organizations:LeaveOrganization action, and apply a Service Control Policy (SCP) to the Deployments OU with a Deny effect, a NotAction block listing the approved services along with necessary IAM and STS actions, and a condition key of ArnNotEquals for aws:PrincipalARN that specifies the PlatformSecurityAuditor role ARN.
To meet all requirements, two SCPs must be applied to the Deployments OU. First, to prevent member accounts from leaving the AWS Organization, the organizations:LeaveOrganization action must be denied in an SCP. Second, to restrict service access while exempting the PlatformSecurityAuditor role, a Deny SCP with a NotAction element is used to list the approved services and essential IAM/STS actions. Using the ArnNotEquals condition with the aws:PrincipalARN key ensures the security auditor role is not subject to the service restriction, while all other roles and the root user are restricted.

Adım Adım Çözüm

1
Analyze how to prevent member accounts from leaving the AWS Organization.
Identify that the organizations:LeaveOrganization action must be blocked at the member account level via an SCP.
SCPs apply to all member accounts in the OU. Denying LeaveOrganization ensures that no identity, including the root user, can remove the account from the organization.
2
Determine how to restrict service access for all roles and the root user except the PlatformSecurityAuditor role.
Formulate a Deny SCP with a NotAction element listing the allowed services (EC2, S3, DynamoDB) and management actions (IAM, STS), then add an ArnNotEquals condition for aws:PrincipalARN.
SCPs apply to the root user, whereas IAM permissions boundaries do not. By default, SCPs filter permissions. A Deny SCP overrides any Allow permissions. The ArnNotEquals condition ensures the auditor role is excluded from this restriction, allowing it to inherit full permissions from its IAM policies.

Anahtar Kavram

SCPs function as permission filters that apply to all users and roles in member accounts, including the root user. To exempt specific roles from global restrictions, conditional Deny policies must be used, as Allow SCPs cannot grant permissions or bypass local IAM restrictions.
Bu soruyu puanla

Konular

Multi-Account Governance and Organizational Structure

Bu konudan daha fazla soru