SAP-C02 · Question #787
A company has separate AWS accounts for each of its departments. The accounts are in OUs that are in an organization in AWS Organizations. The IT department manages a private certificate authority…
The correct answer is D. Use AWS Resource Access Manager (AWS RAM) in the IT account to enable sharing in the. Developer teams in various AWS accounts need to issue certificates from a central AWS Private CA managed by the IT department, while maintaining secure access boundaries.
Question
A company has separate AWS accounts for each of its departments. The accounts are in OUs that are in an organization in AWS Organizations. The IT department manages a private certificate authority (CA) by using AWS Private Certificate Authority in its account. The company needs a solution to allow developer teams in the other departmental accounts to access the private CA to issue certificates for their applications. The solution must maintain appropriate security boundaries between accounts. Which solution will meet these requirements?
Options
- ACreate an AWS Lambda function in the IT account. Program the Lambda function to use the AWS
- BCreate an IAM identity-based policy that allows cross-account access to AWS Private CA. In the
- CIn the organization's management account, create an AWS CloudFormation stack to set up a
- DUse AWS Resource Access Manager (AWS RAM) in the IT account to enable sharing in the
How the community answered
(45 responses)- A2% (1)
- B7% (3)
- C2% (1)
- D89% (40)
Why each option
Developer teams in various AWS accounts need to issue certificates from a central AWS Private CA managed by the IT department, while maintaining secure access boundaries.
Using a Lambda function to mediate certificate issuance would introduce unnecessary complexity, operational overhead, and potential performance bottlenecks compared to direct sharing mechanisms.
An IAM identity-based policy allows principals within the IT account to access the CA, but doesn't inherently facilitate secure cross-account sharing of the CA resource itself to other accounts' principals without using RAM.
Creating a CloudFormation stack in the management account might be used to deploy resources, but it's not the primary or most direct mechanism for sharing an existing Private CA resource across accounts securely within an organization.
AWS Resource Access Manager (AWS RAM) is specifically designed to share AWS resources, including AWS Private CA, securely and easily across AWS accounts within an organization. By sharing the private CA through AWS RAM, developer accounts can issue certificates while the CA remains managed in the IT account, upholding security boundaries.
Concept tested: Cross-account resource sharing with AWS RAM
Source: https://docs.aws.amazon.com/acm-pca/latest/userguide/share-pca.html
Community Discussion
No community discussion yet for this question.