SAP-C02 · Question #650
A company is running multiple workloads in the AWS Cloud. The company has separate units for software development. The company uses AWS Organizations and federation with SAML to give permissions to…
The correct answer is A. Create separate OUs in AWS Organizations for each development unit. Assign the created OUs. The company needs to prevent developers from one unit from managing resources belonging to other units within a shared production account, while still allowing them to manage their own resources.
Question
A company is running multiple workloads in the AWS Cloud. The company has separate units for software development. The company uses AWS Organizations and federation with SAML to give permissions to developers to manage resources in their AWS accounts. The development units each deploy their production workloads into a common production account. Recently, an incident occurred in the production account in which members of a development unit terminated an EC2 instance that belonged to a different development unit. A solutions architect must create a solution that prevents a similar incident from happening in the future. The solution also must allow developers the possibility to manage the instances used for their workloads. Which strategy will meet these requirements?
Options
- ACreate separate OUs in AWS Organizations for each development unit. Assign the created OUs
- BPass an attribute for DevelopmentUnit as an AWS Security Token Service (AWS STS) session
- CPass an attribute for DevelopmentUnit as an AWS Security Token Service (AWS STS) session
- DCreate separate IAM policies for each development unit. For every IAM policy, add an allow
How the community answered
(20 responses)- A65% (13)
- B5% (1)
- C10% (2)
- D20% (4)
Why each option
The company needs to prevent developers from one unit from managing resources belonging to other units within a shared production account, while still allowing them to manage their own resources.
Creating separate Organizational Units (OUs) for each development unit and applying Service Control Policies (SCPs) at the OU level allows for granular control over permissions specific to each unit, preventing cross-unit resource modification. This approach logically separates and manages permissions for different development units within a common production account, providing the necessary isolation.
Passing `DevelopmentUnit` as an AWS STS session tag enables attribute-based access control (ABAC) but is insufficient alone, as existing broad IAM policies might still permit cross-unit actions without consistent enforcement of resource tagging.
While AWS STS session tags are for ABAC, the example policy grants `ec2:*` permissions without specific conditions, which would still allow developers to manage all EC2 instances, regardless of unit.
Creating separate IAM policies for each development unit with specific resource ARNs is unscalable and difficult to maintain for dynamically created resources like EC2 instances, as new instances would require constant policy updates.
Concept tested: AWS Organizations SCPs for resource isolation
Source: https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html
Community Discussion
No community discussion yet for this question.