Q32 — AWS SAA-C03 Ch.11

Question 32 of 100 | ← Chapter 11

Q732. A solutions architect is designing a security solution for a company that wants to provide developers with individual AWS accounts through AWS Organizations, while also maintaining standard security controls. Because the individual developers will have AWS account root user-level access to their own accounts, the solutions architect wants to ensure that the mandatory AWS CloudTrail configuration that is applied to new developer accounts is not modified.Which action meets these requirements?

Correct Answer: C. Create a service control policy (SCP) that prohibits changes to CloudTrail, and attach it the developer accounts.

Explanation

To meet the requirement of providing developers with individual AWS accounts through AWS Organizations while ensuring that the mandatory AWS CloudTrail configuration is not modified, the most suitable action is:C. Create a service control policy (SCP) that prohibits changes to CloudTrail and attach it to the developer accounts.Option C, creating a service control policy (SCP) that prohibits changes to CloudTrail and attaching it to the developer accounts, is the recommended action to meet the requirements:- Service Control Policies (SCPs): SCPs are a feature of AWS Organizations that allow you to set fine-grained permissions at the account level. SCPs provide central control over the maximum permissions that can be assigned to an account. They can be used to set restrictions on services, actions, and resource types.By creating an SCP that prohibits changes to CloudTrail, you can ensure that developers in their individual AWS accounts cannot modify the CloudTrail configuration. This prevents them from accidentally or intentionally altering the mandatory CloudTrail settings that need to be maintained.You can attach the SCP to the developer accounts within AWS Organizations to enforce the restriction. This way, even though the developers have AWS account root user-level access, they will be subject to the restrictions imposed by the SCP and will not be able to modify the CloudTrail configuration.Option A, creating an IAM policy that prohibits changes to CloudTrail and attaching it to the root user, is not the most appropriate action for this scenario. The IAM policy is attached at the user level, and in this case, the developers will have individual AWS accounts. Therefore, attaching the policy to the root user is not an effective way to enforce the restriction across the developer accounts.Option B, creating a new trail in CloudTrail from within the developer accounts with the organization trails option enabled, is not the optimal action for ensuring that the mandatory CloudTrail configuration is not modified. Enabling the organization trails option allows CloudTrail to aggregate logs from all accounts within the organization, but it does not prevent modifications to the individual CloudTrail configurations.Option D, creating a service-linked role for CloudTrail with a policy condition that allows changes only from an Amazon Resource Name (ARN) in the management account, does not address the requirement of providing individual AWS accounts to developers while ensuring that the mandatory CloudTrail configuration is not modified. It focuses on controlling access to CloudTrail based on the management account, rather than applying restrictions on the developer accounts themselves.Therefore, the action that best meets the requirements is C: Create a service control policy (SCP) that prohibits changes to CloudTrail and attach it to the developer accounts. This action allows you to set fine-grained permissions at the account level and enforce the restriction on modifying the CloudTrail configuration across the individual developer accounts.