SCS-C02 Question 208
Select 3Your company has recently adopted AWS Organizations to centralize the management of multiple AWS accounts. As a security engineer, you have been tasked with ensuring that all accounts under the organization adhere to strict baseline security policies. Which of the following measures can you implement to enforce security policies across all accounts in the organization?
- A
Use Service Control Policies (SCPs) to restrict actions on AWS accounts within the organization.
- B
Enable AWS Config in the management account and use it to audit resources in all accounts within the organization.
- C
Configure AWS IAM Identity Center (SSO) to enforce security policies across all member accounts.
- D
Enable GuardDuty in the management account and delegate findings to member accounts for enforcement.
- E
Implement tag policies in AWS Organizations to enforce consistent tagging across all accounts.
Show answer and explanation
Correct answers: A, B, E
Explanation
To enforce baseline security policies across AWS accounts in an organization, you can leverage Service Control Policies (SCPs) to restrict actions, use AWS Config to audit and evaluate compliance, and implement tag policies to maintain consistent resource tagging. While IAM Identity Center and GuardDuty are important security tools, they are not used for enforcing organization-wide security policies directly.
- A. Correct.
Service Control Policies (SCPs) are a feature of AWS Organizations and are specifically designed to enforce permissions guardrails on member accounts. This is a valid method to enforce security policies.
- B. Correct.
AWS Config can be enabled across all accounts using AWS Organizations, allowing you to audit and evaluate compliance of resources against security policies. This is a valid measure.
- C. Incorrect.
AWS IAM Identity Center (SSO) is used for centralized access management, not for enforcing security policies across accounts. This is not correct.
- D. Incorrect.
GuardDuty is a threat detection service, and while it provides security insights, it does not enforce security policies across accounts. This is not correct.
- E. Correct.
Tag policies in AWS Organizations help ensure consistent tagging across resources, which can contribute to a security baseline by enabling proper resource identification and tracking. This is a valid measure.