Examkin

Soru

Zorluk: ZorMulti-Account Governance and Organizational Structure

An enterprise manages its multi-account environment using AWS Organizations. The account structure includes a Security Organizational Unit (OU) and a Workloads OU. The security team has defined a policy stating that member accounts within the Workloads OU must never disable AWS Security Hub, delete Amazon GuardDuty detectors, or stop AWS Config recorders. However, during incident response operations, a centralized security role named SecurityIncidentResponseRole, which is provisioned across all member accounts, must be able to perform these administrative tasks to remediate issues. The solution must ensure these compliance guardrails are automatically applied to new accounts in the Workloads OU and cannot be bypassed by local account administrators or the root user.

Which solution meets these requirements with the least operational overhead?

  1. A
    Define an IAM permissions boundary that denies the security modification actions. Apply this permissions boundary to all IAM users and roles in the member accounts within the Workloads OU. Use AWS Systems Manager to automate the boundary attachment for any newly created accounts.
  2. Create a Service Control Policy (SCP) that denies the securityhub:DisableSecurityHub, guardduty:DeleteDetector, and config:DeleteConfigurationRecorder actions. Add a condition to the SCP using the ArnNotEquals operator to exclude arn:aws:iam::*:role/SecurityIncidentResponseRole from the restriction. Attach the SCP to the Workloads OU.Cevap
  3. C
    Configure the SAML 2.0 identity federation trust relationship for all member accounts to map federated users to an IAM role that lacks permissions for these security actions. Restrict the trust policy of the SecurityIncidentResponseRole to only accept SAML assertions from the centralized security identity provider.
  4. D
    Create a centralized S3 bucket and an AWS KMS customer managed key (CMK) in the Security account. Update the bucket policy and KMS key policy to deny all write operations unless the caller's principal ARN is arn:aws:iam::*:role/SecurityIncidentResponseRole. Configure all workload accounts to log to this bucket.

Cevap

Create a Service Control Policy (SCP) that denies the securityhub:DisableSecurityHub, guardduty:DeleteDetector, and config:DeleteConfigurationRecorder actions. Add a condition to the SCP using the ArnNotEquals operator to exclude arn:aws:iam::*:role/SecurityIncidentResponseRole from the restriction. Attach the SCP to the Workloads OU.
The correct solution uses a Service Control Policy (SCP) attached to the Workloads Organizational Unit (OU) to enforce restrictions across all member accounts. Because SCPs apply to all users and roles within member accounts, including the root user, they serve as effective administrative guardrails that cannot be bypassed by local administrators. By using the ArnNotEquals condition key on aws:PrincipalARN, the policy successfully excludes the specified incident response role from the deny statement, enabling central security teams to perform necessary remediation actions. Attaching the SCP to the OU ensures that any newly created accounts automatically inherit these restrictions, providing maximum operational efficiency.

Adım Adım Çözüm

1
Identify the governance mechanism that can restrict the root user and all administrative roles in member accounts.
Service Control Policies (SCPs) are selected because they establish permission guardrails that apply to all principals in member accounts, including the root user, and cannot be modified or bypassed by local account administrators.
IAM permissions boundaries and local IAM policies cannot restrict the root user and can be detached by local administrators with IAM privileges.
2
Determine the method to apply the restrictions automatically to new accounts.
Attach the SCP directly to the Workloads Organizational Unit (OU).
AWS Organizations supports policy inheritance, meaning any sub-OUs or child accounts added to the Workloads OU automatically inherit the attached SCP, minimizing operational overhead.
3
Configure the exclusion rule within the SCP for the centralized security role.
Add a Deny rule with a condition block using the ArnNotEquals operator, targeting aws:PrincipalARN with the wildcard pattern matching the role across all accounts.
The condition evaluates to false when the caller is the specified role, bypassing the Deny effect and allowing the role to perform the required actions, while applying the Deny to all other principals.

Anahtar Kavram

Organizational governance using Service Control Policies (SCPs) with conditional exclusions
Tahmini Süre:3m 0s
Bu soruyu puanla

Konular

Multi-Account Governance and Organizational Structure

Bu konudan daha fazla soru