An enterprise manages its multi-account environment using AWS Organizations. The organization contains a parent Organizational Unit (OU) named Workloads, which has a child OU named Production. The security team wants to ensure that: 1. No member accounts in the Production OU can delete AWS CloudTrail trails or stop logging. 2. The security administration team, operating from a delegated administrator account for CloudTrail located under a separate Security OU, can still manage organization-level trails. An administrator attaches a Service Control Policy (SCP) to the Workloads OU that denies the cloudtrail:StopLogging and cloudtrail:DeleteTrail actions. Which of the following describes the impact of this policy configuration on the accounts?
- It restricts all IAM identities, including local administrators and the root user, within the Production OU member accounts from modifying CloudTrail, while leaving the delegated administrator account in the Security OU unaffected by the SCP.Cevap
- BIt restricts only non-administrative IAM users in the Production OU, allowing local administrators and the root user of those accounts to modify CloudTrail as long as they have full IAM permissions.
- CIt automatically grants permissions to the security administration team to manage CloudTrail across the organization, overriding the need for local IAM policies in the member accounts.
- DIt restricts the delegated administrator account from managing organization-level trails because SCPs attached to any OU within AWS Organizations automatically apply globally to all accounts, including the management account.