DOP-C02 Question 348
Single answerYour organization has hundreds of AWS accounts managed under a single AWS Organizations setup. You need to enforce a consistent set of IAM policies across all accounts at scale to ensure compliance with security requirements. Additionally, you need to restrict specific actions for certain services globally while allowing each account to maintain its own unique IAM roles and policies. Which approach should you take?
- A
Use AWS Service Control Policies (SCPs) in AWS Organizations to define and enforce permissions at the organizational level.
- B
Use AWS Identity Center (formerly AWS SSO) to propagate IAM roles and policies across all accounts in the organization.
- C
Create a Lambda function in each account to periodically synchronize IAM policies from a central account.
- D
Manually copy and apply IAM policies to each AWS account to ensure consistency.
Show answer and explanation
Correct answer: A
Explanation
Service Control Policies (SCPs) are specifically designed to enforce permissions at scale across multiple AWS accounts within an AWS Organization. They allow you to define global permission boundaries while still giving individual accounts the flexibility to manage their own IAM roles and policies within those boundaries. This makes SCPs the most appropriate and scalable solution for implementing identity and access management at scale in this scenario.
- A. Correct.
Service Control Policies (SCPs) allow you to enforce permission boundaries at the AWS Organizations level, ensuring consistent access controls across all accounts while allowing individual accounts to manage their own IAM roles and policies within the defined boundaries.
- B. Incorrect.
AWS Identity Center (AWS SSO) helps in centralized access management but does not enforce IAM policies or restrict actions at the organizational level.
- C. Incorrect.
Using Lambda functions in each account to synchronize IAM policies would be a highly complex and inefficient solution to enforce policies at scale. Additionally, this approach lacks the centralized governance and control offered by SCPs.
- D. Incorrect.
Manually copying and applying IAM policies is a time-consuming and error-prone process, particularly in large environments with hundreds of accounts. It is not a scalable or recommended approach.