SAP-C02 · Question #128
A solutions architect uses AWS Organizations to manage several AWS accounts for a company. The full Organizations feature set is activated for the organization. All production AWS accounts exist…
The correct answer is A. Write an SCP that denies the CreateSecurityGroup action with a condition o( ec2:tngress rule. To prevent the creation of new security group rules allowing inbound TCP port 22 in production accounts and ensure compliance, an AWS Organizations Service Control Policy (SCP) should be implemented to deny the ec2:AuthorizeSecurityGroupIngress action for port 22.
Question
A solutions architect uses AWS Organizations to manage several AWS accounts for a company. The full Organizations feature set is activated for the organization. All production AWS accounts exist under an OU that is named "production" Systems operators have full administrative privileges within these accounts by using IAM roles. The company wants to ensure that security groups in all production accounts do not allow inbound traffic for TCP port 22. All noncompliant security groups must be remediated immediately, and no new rules that allow port 22 can be created. Winch solution will meet these requirements?
Options
- AWrite an SCP that denies the CreateSecurityGroup action with a condition o( ec2:tngress rule
- BConfigure an AWS CloudTrail trail for all accounts Send CloudTrail logs to an Amazon S3 bucket
- CCreate an Amazon EvertBridge (Amazon CloudWatch Events) event bus in the Organizations
- DCreate an AWS CloudFormation template to turn on AWS Config Activate the
How the community answered
(44 responses)- A68% (30)
- B5% (2)
- C9% (4)
- D18% (8)
Why each option
To prevent the creation of new security group rules allowing inbound TCP port 22 in production accounts and ensure compliance, an AWS Organizations Service Control Policy (SCP) should be implemented to deny the `ec2:AuthorizeSecurityGroupIngress` action for port 22.
An AWS Organizations Service Control Policy (SCP) can proactively deny the `ec2:AuthorizeSecurityGroupIngress` action when a condition specifies inbound TCP port 22. This effectively prevents the creation of any new security group rules that allow port 22 in all accounts within the 'production' OU, directly meeting the 'no new rules can be created' requirement.
AWS CloudTrail logs API calls for auditing and detection but does not proactively prevent actions from occurring or automatically remediate non-compliant resources.
Amazon EventBridge can trigger actions (like a Lambda function for remediation) in response to security group changes, but it does not prevent the initial creation of non-compliant rules; it is a reactive mechanism.
AWS Config detects non-compliant resources and can initiate remediation after a non-compliant rule is created. While it addresses 'remediated immediately,' it does not prevent the creation of the non-compliant rule in the first place, unlike an SCP.
Concept tested: AWS Organizations SCPs, preventative security controls
Source: https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html
Community Discussion
No community discussion yet for this question.