Examkin

Soru

Zorluk: ZorMulti-Account Governance and Organizational Structure

A high-growth fintech startup organizes its workloads across several AWS accounts managed under AWS Organizations. The security team has defined a strict governance posture: Sandbox accounts, grouped under a dedicated 'Sandbox' Organizational Unit (OU), must be limited to using only Amazon EC2, Amazon S3, and AWS Lambda. Local administrators in the Sandbox accounts must not be allowed to modify, delete, or bypass a centralized security monitoring IAM role named 'CentralSecurityAuditRole' deployed in each account. Additionally, developers in the Sandbox accounts must retain the ability to create and manage their own local IAM roles and policies for application testing, without the capability of elevating their permissions to modify the security monitoring role. Which design strategy should a solutions architect implement to meet these requirements with the least administrative overhead?

  1. A
    Attach a Service Control Policy (SCP) to the Sandbox OU that explicitly grants permissions for EC2, S3, and Lambda, while relying on the SCP to automatically deny local administrators the ability to delete any IAM role that starts with 'CentralSecurityAuditRole'.
  2. B
    Define the permission limitations in a customer managed policy, share this policy with the Sandbox accounts using AWS Resource Access Manager (RAM), and instruct the local administrators to apply this shared policy as a permissions boundary on all developer-created IAM roles.
  3. Attach a Service Control Policy (SCP) to the Sandbox OU that denies all actions not belonging to the EC2, S3, and Lambda service namespaces, and denies all IAM modification and deletion actions where the resource matches the ARN of the 'CentralSecurityAuditRole'. Allow the default FullAWSAccess SCP to remain, and instruct developers to use local IAM policies for granting their day-to-day permissions.Cevap
  4. D
    Configure a Service Control Policy (SCP) that restricts service access to EC2, S3, and Lambda. To protect the auditing role, deploy a local IAM policy in each account that denies access to the role, and configure the SAML federation trust relationship to block developers from assuming any roles that possess IAM write capabilities.

Cevap

The correct strategy is to attach an SCP to the Sandbox OU that denies all actions outside the EC2, S3, and Lambda namespaces, and denies all IAM modification/deletion actions targeting the specific CentralSecurityAuditRole ARN, while using local IAM policies to grant permissions.
The correct strategy uses an SCP to restrict services and protect the centralized monitoring role. An SCP functions as a filter that restricts the maximum allowed permissions for accounts under an OU, but does not grant permissions directly. By explicitly denying IAM write or deletion operations targeting the ARN of the security auditing role, even administrators with local Full AdministratorAccess are prevented from modifying it. Developers are still permitted to create and manage local IAM roles since the deny is resource-specific. Local IAM policies are then used to grant actual operational permissions.

Adım Adım Çözüm

1
Identify the mechanism to restrict services globally for the Sandbox OU.
Determine that a Service Control Policy (SCP) attached to the Sandbox OU is the correct tool to set permission guardrails and limit API access to EC2, S3, and Lambda.
SCPs are policy-based controls used to manage permissions in an organization, defining the maximum permissions for member accounts.
2
Determine how to protect the central security role from being deleted by local administrators.
Select an SCP deny statement targeting the specific IAM role ARN to prevent modification or deletion.
A Deny statement in an SCP overrides any local administrator permissions and cannot be bypassed by local admins in the member accounts.
3
Evaluate the options for granting developers permission to manage local IAM roles.
Ensure the SCP's deny statement is resource-specific (targeting only the central security role) rather than blocking all IAM operations, and use local IAM policies for general access.
This allows developers to manage other IAM roles as required while protecting the critical auditing role.

Anahtar Kavram

Service Control Policies (SCPs) act as permission boundaries/filters for AWS Organizations member accounts and can restrict actions even for local administrator accounts.
Tahmini Süre:3m 0s
Bu soruyu puanla

Konular

Multi-Account Governance and Organizational Structure

Bu konudan daha fazla soru