DOP-C02 Question 350
Select 2Your organization has adopted AWS Organizations to manage multiple AWS accounts. The security team has mandated that no IAM users should exist in individual accounts and all access must be managed centrally. You need to implement a scalable solution to enforce this policy across all accounts. Which of the following approaches should you take?
- A
Enable AWS Single Sign-On (AWS SSO) and integrate it with AWS Organizations to manage user access centrally.
- B
Use AWS Config with a custom rule to detect and remediate the creation of any IAM users in member accounts.
- C
Create a Service Control Policy (SCP) that denies the 'iam:CreateUser' action and apply it to all accounts in the organization.
- D
Deploy an AWS Lambda function in each account to automatically delete any IAM users that are created.
Show answer and explanation
Correct answers: A, C
Explanation
To enforce identity and access management at scale, a combination of AWS SSO for centralized user access and Service Control Policies (SCPs) for preventative control is the most scalable and effective solution. AWS SSO eliminates the need for IAM users in individual accounts, while SCPs ensure that policies like denying the creation of IAM users are enforced across the entire AWS Organization.
- A. Correct.
This is a correct option. AWS Single Sign-On (AWS SSO) allows you to manage user access centrally across multiple AWS accounts in AWS Organizations, ensuring no need for individual IAM users in member accounts.
- B. Incorrect.
While AWS Config can detect and remediate certain configurations, it is not the most scalable or efficient solution for enforcing identity and access policies across all accounts in AWS Organizations.
- C. Correct.
This is a correct option. By creating an SCP that denies the 'iam:CreateUser' action, you can enforce the policy at the organization level, ensuring no IAM users can be created in any member account.
- D. Incorrect.
Using Lambda to delete IAM users is not a scalable or efficient solution because it requires deployment and maintenance in each account. Additionally, it is reactive rather than preventative.