SCS-C02 · Question #430
A company uses AWS Organizations to manage a small number of AWS accounts. However, the company plans to add 1,000 more accounts soon. The company allows only a centralized security team to create…
The correct answer is D. Create an SCP and a permissions boundary for IAM roles. Add the SCP to the root OU so that. This solution allows application teams to create their own IAM roles while ensuring that the permissions boundary restricts the permissions of those roles, preventing privilege escalation. By attaching the Service Control Policy (SCP) at the root OU level, you enforce this…
Question
A company uses AWS Organizations to manage a small number of AWS accounts. However, the company plans to add 1,000 more accounts soon. The company allows only a centralized security team to create IAM roles for all AWS accounts and teams. Application teams submit requests for IAM roles to the security team. The security team has a backlog of IAM role requests and cannot review and provision the IAM roles quickly. The security team must create a process that will allow application teams to provision their own IAM roles. The process must also limit the scope of IAM roles and prevent privilege escalation. Which solution will meet these requirements with the LEAST operational overhead?
Options
- ACreate an IAM group for each application team. Associate policies with each IAM group.
- BDelegate application team leads to provision IAM roles for each team. Conduct a quarterly review
- CPut each AWS account in its own OU. Add an SCP to each OU to grant access to only the AWS
- DCreate an SCP and a permissions boundary for IAM roles. Add the SCP to the root OU so that
How the community answered
(52 responses)- A2% (1)
- B12% (6)
- C4% (2)
- D83% (43)
Explanation
This solution allows application teams to create their own IAM roles while ensuring that the permissions boundary restricts the permissions of those roles, preventing privilege escalation. By attaching the Service Control Policy (SCP) at the root OU level, you enforce this boundary across all accounts. This approach provides the necessary flexibility for application teams to provision their own roles while ensuring security and preventing excessive permissions, all with minimal operational overhead.
Topics
Community Discussion
No community discussion yet for this question.