DOP-C02 · Question #293
A company uses an organization in AWS Organizations that a security team and a DevOps team manage. Both teams access the accounts by using AWS IAM Identity Center. A dedicated group has been created…
The correct answer is D. In IAM Identity Center, update the DevOps permission set. Ensure that the assigned policy has. Explanation Why D is Correct: The issue lies within IAM Identity Center itself - the DevOps permission set uses AdministratorAccess, which grants full access including to IAM Identity Center. Updating the DevOps permission set to explicitly deny IAM Identity Center actions…
Question
A company uses an organization in AWS Organizations that a security team and a DevOps team manage. Both teams access the accounts by using AWS IAM Identity Center. A dedicated group has been created for each team. The DevOps team's group has been assigned a permission set named DevOps. The permission set has the AdministratorAccess managed IAM policy attached. The permission set has been applied to all accounts in the organization. The security team wants to ensure that the DevOps team does not have access to IAM Identity Center in the organization's management account. The security team has attached the following SCP to the organization root:
After implementing the policy, the security team discovers that the DevOps team can still access IAM Identity Center. Which solution will fix the problem?
Options
- AIn the organization's management account, create a new OU. Move the organization's
- BIn the organization's management account, update the SCP condition reference to the ARN of the
- CIn IAM Identity Center, create a new permission set. Ensure that the assigned policy has full
- DIn IAM Identity Center, update the DevOps permission set. Ensure that the assigned policy has
How the community answered
(43 responses)- A7% (3)
- B23% (10)
- C5% (2)
- D65% (28)
Explanation
Explanation
Why D is Correct: The issue lies within IAM Identity Center itself - the DevOps permission set uses AdministratorAccess, which grants full access including to IAM Identity Center. Updating the DevOps permission set to explicitly deny IAM Identity Center actions (using an inline policy with a Deny effect for sso:* actions) addresses the problem at the source, since SCPs do not apply to the management account's root users or to IAM Identity Center service-linked operations in the management account.
Why the Distractors are Wrong:
- A is incorrect because moving the management account to a new OU does not resolve the issue - the management account cannot be moved out of the root, and SCPs have limited effect on the management account itself.
- B is incorrect because updating the SCP condition to reference an ARN doesn't fix the core problem; SCPs still won't restrict actions in the management account as expected, since the management account is exempt from SCP restrictions.
- C is incorrect because creating a new permission set with full access doesn't restrict IAM Identity Center access - it would only add more permissions rather than removing the problematic ones.
Memory Tip
Remember: "SCPs don't protect the management account from itself" - when you need to restrict access within the management account, you must apply controls directly at the IAM Identity Center permission set level, not through SCPs.
Topics
Community Discussion
No community discussion yet for this question.