Examkin

Soru

Zorluk: OrtaMulti-Account Governance and Organizational Structure

A global logistics provider manages its multi-account environment using AWS Organizations. The environment contains a Development OU, a Production OU, and a Security OU. The security team wants to establish a governance policy that prevents developers, including root users in the member accounts under the Development OU, from disabling AWS CloudTrail or modifying its configurations. Additionally, the team needs to enable AWS GuardDuty across all current and future member accounts, with administration centralized in the Security OU account. Which approach meets these governance requirements with the least administrative overhead?

  1. Attach a Service Control Policy (SCP) to the Development OU that denies cloudtrail:StopLogging, cloudtrail:UpdateTrail, and cloudtrail:DeleteTrail actions. In the AWS Organizations management account, register the Security OU account as the delegated administrator for AWS GuardDuty. From the GuardDuty console in the Security OU account, enable GuardDuty for all current and future member accounts within the organization.Cevap
  2. B
    Attach a Service Control Policy (SCP) to the Development OU that permits cloudtrail:StartLogging and explicitly denies all other CloudTrail actions, assuming this SCP grants permissions to the developers without requiring local IAM policies. Register the Security OU account as the delegated administrator for AWS GuardDuty from the organization management account.
  3. C
    Attach an IAM permissions boundary to all roles in the Development OU member accounts that denies cloudtrail:StopLogging, cloudtrail:UpdateTrail, and cloudtrail:DeleteTrail. Share the GuardDuty detector from the Security OU account to all member accounts using AWS Resource Access Manager (RAM) to allow centralized security management.
  4. D
    Create a Customer Managed Key (CMK) in the Security OU account to encrypt CloudTrail logs. In each member account under the Development OU, create a local IAM role with a trust policy configured to allow the Security OU account's IAM roles to assume it and manage CloudTrail directly, without using SCPs. In the AWS Organizations management account, enable GuardDuty and configure it to replicate alerts to the Security OU account using a SAML 2.0 federated role trust relationship.

Cevap

The correct approach involves attaching a deny Service Control Policy (SCP) for CloudTrail modifications to the Development OU, and registering the Security OU account as the delegated administrator for AWS GuardDuty to enable it organization-wide.
The correct solution uses a Service Control Policy (SCP) to enforce an absolute guardrail that prevents any entity, including the root user, from modifying CloudTrail settings in the Development OU. Concurrently, it leverages AWS Organizations delegated administration for GuardDuty to automate security monitoring across the entire organization from a central security account, minimizing operational complexity.

Adım Adım Çözüm

1
Identify the governance mechanism required to prevent any user (including root) from modifying AWS CloudTrail.
Determine that a Service Control Policy (SCP) attached at the Organizational Unit (OU) or account level is required, as local IAM policies and permissions boundaries can be bypassed by root users or local administrators.
SCPs act as guardrails that define the maximum available permissions for member accounts, overriding even local administrative privileges.
2
Identify the correct way to centralize security operations (like GuardDuty) across all member accounts with minimal overhead.
Determine that registering the Security OU account as the delegated administrator for AWS GuardDuty is the AWS-recommended approach.
Delegated administration allows the designated security account to manage the service, enable detectors, and aggregate findings organization-wide without requiring credentials in the management account.
3
Combine these governance actions into a single comprehensive solution and evaluate against the options.
The solution that combines attaching a deny-based SCP for CloudTrail modification to the Development OU and registering the Security OU account as the delegated administrator for GuardDuty is the correct path.
This satisfies all security constraints while maintaining operational efficiency and adhering to the AWS well-architected multi-account guidance.

Anahtar Kavram

Implementing Multi-Account Governance with SCP Guardrails and Delegated Service Administration
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Multi-Account Governance and Organizational Structure

Bu konudan daha fazla soru