Examkin

Soru

Zorluk: ZorMulti-Account Governance and Organizational Structure

A multinational enterprise is building a multi-account landing zone using AWS Organizations. The solutions architect must establish a governance framework that enforces security guardrails while maintaining operational delegation. The requirements are as follows:
- Centralized security services, such as Amazon GuardDuty, must be managed by a designated Security team account, avoiding any administrative actions in the Organization's management account.
- Service Control Policies (SCPs) must restrict member accounts in the 'Workloads' Organizational Unit (OU) from deploying resources in unauthorized AWS Regions, while ensuring that the SCPs do not inadvertently grant permissions to local IAM identities.

Which of the following actions should the solutions architect take to meet these requirements? (Select TWO.)

  1. Designate the Security account as the delegated administrator for Amazon GuardDuty from the AWS Organizations management account.Cevap
  2. Attach a Service Control Policy (SCP) to the Workloads OU that uses a Deny effect for all actions with a condition restricting operations to the approved Regions, excluding global services, and configure local IAM policies within member accounts to grant developer permissions.Cevap
  3. C
    Attach an SCP to the Workloads OU that explicitly allows deployment permissions only within the approved Regions, thereby granting those permissions directly to all IAM entities in the member accounts.
  4. D
    Establish cross-account federated roles by configuring a SAML trust policy in the Security account with the sts:AssumeRole action, rather than using AWS Organizations delegated administration.
  5. E
    Enable resource sharing outside the organization via AWS Resource Access Manager (RAM) in the management account to share GuardDuty configuration data with the Security account.

Cevap

The solutions architect should designate the Security account as the delegated administrator for Amazon GuardDuty and attach a Deny-based SCP to the Workloads OU to restrict regions, while continuing to configure local IAM policies to grant permissions.
Delegated administration allows organizations to decouple service management from the management account. Using a Deny-based SCP to restrict regions ensures that unauthorized operations are blocked at the boundary, while local IAM policies actually grant permissions to users.

Adım Adım Çözüm

1
Enable delegated administration for security services.
The designated Security account has the authority to manage GuardDuty detectors and member account associations across the Organization.
This avoids performing operational tasks in the Organization's management account, aligning with AWS best practices for multi-account management.
2
Implement a Deny-based SCP for Region restrictions.
API calls to deploy resources in unauthorized regions are blocked at the OU boundary, while allowed global services continue to function.
SCPs act as filters rather than direct permission providers. A Deny policy ensures that even if local IAM policies permit global deployments, unauthorized regions are blocked.
3
Define local IAM policies within the member accounts.
Developer roles are granted access to specific resources and services locally within the boundaries permitted by the SCP.
Because SCPs do not grant permissions, local IAM policies must still be present to allow actions to succeed.

Anahtar Kavram

Delegating administration for organizational services and using SCPs as permission boundaries (filters) rather than direct permission grants.
Bu soruyu puanla

Konular

Multi-Account Governance and Organizational Structure

Bu konudan daha fazla soru