Examkin

Soru

Zorluk: ZorMulti-Account Governance and Organizational Structure

An enterprise is designing a multi-account AWS environment using AWS Organizations. The security team must enforce the following compliance requirements:

1. Member accounts must not be able to disable or disassociate Amazon GuardDuty.
2. A custom IAM role named `SecurityAuditRole` in member accounts, which is used for security scanning, must be protected against modification or deletion by any user in those accounts.
3. Centralized AWS CloudTrail logs from all member accounts must be encrypted in a dedicated S3 bucket in a Security account using an encryption key that permits cross-account log delivery.

Which combination of actions will meet these requirements with the least operational complexity?

  1. Apply a Service Control Policy (SCP) at the Organization root that denies guardduty:Delete* and guardduty:Disassociate*, and denies IAM write actions where the resource is arn:aws:iam::*:role/SecurityAuditRole. Ensure local users in member accounts are granted permissions via local IAM policies. For CloudTrail, encrypt the S3 bucket in the Security account using an AWS KMS customer managed key, and update its key policy to allow the CloudTrail service principal from the Organization to perform cryptographic operations.Cevap
  2. B
    Apply a Service Control Policy (SCP) at the Organization root that grants full administrator privileges to all users, except for denying guardduty:Delete* and guardduty:Disassociate*, and denying IAM write actions on arn:aws:iam::*:role/SecurityAuditRole. Rely on this SCP to grant access to member account users without configuring local IAM policies. For CloudTrail, encrypt the S3 bucket in the Security account using an AWS KMS customer managed key, and update its key policy to allow the CloudTrail service principal.
  3. C
    Apply a Service Control Policy (SCP) at the Organization root that denies guardduty:Delete* and guardduty:Disassociate*, and denies IAM write actions where the resource is arn:aws:iam::*:role/SecurityAuditRole. In the member accounts, grant permissions via local IAM policies. For CloudTrail, encrypt the S3 bucket in the Security account using the default AWS managed key (aws/s3), and configure the key policy of aws/s3 to allow the CloudTrail service principal from all member accounts to perform cryptographic operations.
  4. D
    Apply a Service Control Policy (SCP) at the Organization root that denies guardduty:Delete* and guardduty:Disassociate*, and denies IAM write actions on arn:aws:iam::*:role/SecurityAuditRole. Create the SecurityAuditRole in all member accounts and establish a trust relationship with an external SAML identity provider, specifying the sts:AssumeRole action in the trust policy instead of sts:AssumeRoleWithSAML to simplify federated access. For CloudTrail, encrypt the S3 bucket in the Security account using an AWS KMS customer managed key.

Cevap

Apply a Service Control Policy (SCP) at the Organization root that denies guardduty:Delete* and guardduty:Disassociate*, and denies IAM write actions where the resource is the specific SecurityAuditRole. Ensure local users in member accounts are granted permissions via local IAM policies. For CloudTrail, encrypt the S3 bucket in the Security account using an AWS KMS customer managed key, and update its key policy to allow the CloudTrail service principal from the Organization to perform cryptographic operations.
The correct solution uses an Organization-level SCP to restrict administrative actions (GuardDuty deletion and modification of the SecurityAuditRole) while relying on local IAM policies to grant permissions. It also uses a customer managed KMS key to support cross-account log encryption for CloudTrail, which is a requirement since AWS-managed keys cannot be shared across accounts.

Adım Adım Çözüm

1
Enforce preventative guardrails using AWS Organizations Service Control Policies (SCPs).
SCPs are applied at the root of the Organization, preventing all roles/users (including root users of member accounts) from deleting/disassociating GuardDuty or modifying the SecurityAuditRole.
SCPs establish permission boundaries across the multi-account structure but do not grant permissions directly.
2
Configure local IAM permissions inside member accounts.
Local administrators configure IAM users, groups, or roles with policy access.
Since SCPs only filter permissions, local IAM policies are still required to grant active permissions.
3
Set up centralized logging and custom key encryption.
Create a customer managed key (CMK) in KMS in the Security account, configure its policy to allow CloudTrail from the Organization to encrypt logs, and specify this key for the S3 bucket encryption.
AWS-managed KMS keys (like aws/s3) cannot be shared across accounts or customized, necessitating the use of a Customer Managed Key.

Anahtar Kavram

AWS Organizations SCP boundaries combined with Customer Managed KMS Keys for cross-account governance.
Bu soruyu puanla

Konular

Multi-Account Governance and Organizational Structure

Bu konudan daha fazla soru