SAP-C02 Question 426
Single answerA company is running a multi-account AWS environment and has implemented AWS Organizations. The Security team needs to ensure that all accounts comply with security policies by enforcing encryption at rest for all S3 buckets and logging for CloudTrail. They also want to ensure that no one can disable these policies, even administrators in member accounts. Which solution best meets these requirements?
- A
Use Service Control Policies (SCPs) to deny actions that disable S3 Bucket Encryption and CloudTrail logging.
- B
Enable AWS Config Rules in each account to enforce S3 Bucket Encryption and CloudTrail logging.
- C
Use IAM policies in each member account to restrict permissions for disabling S3 Bucket Encryption and CloudTrail logging.
- D
Create a Lambda function triggered by CloudWatch Events to automatically re-enable encryption and logging if they are disabled.
Show answer and explanation
Correct answer: A
Explanation
Service Control Policies (SCPs) are the most appropriate solution for enforcing security and compliance across a multi-account AWS environment managed by AWS Organizations. SCPs provide centralized, preventive controls that apply to all accounts in the organization, ensuring that critical security settings like S3 bucket encryption and CloudTrail logging cannot be disabled, even by administrators in member accounts. Other solutions, such as AWS Config Rules or IAM policies, are either reactive or limited in scope and cannot guarantee the required level of enforcement.
- A. Correct.
Correct. Service Control Policies (SCPs) are managed at the AWS Organizations level and allow you to enforce guardrails across all accounts. By creating an SCP that denies actions to disable S3 bucket encryption and CloudTrail logging, you ensure compliance and prevent administrators in member accounts from overriding these rules.
- B. Incorrect.
Incorrect. AWS Config Rules are useful for monitoring and alerting on non-compliance, but they cannot enforce preventive controls or automatically deny actions.
- C. Incorrect.
Incorrect. IAM policies are account-specific and cannot override permissions at the organizational level. Administrators in member accounts could remove or modify these policies.
- D. Incorrect.
Incorrect. While a Lambda function could re-enable encryption and logging, it introduces a delay and does not prevent the disabling actions from occurring in the first place.