Q19 — AWS SAA-C03 Ch.16

Question 19 of 100 | ← Chapter 16

Q1219. A company uses AWS Organizations to group multiple AWS accounts into organizational units (OUs).Each OU has service control policies (SCPs) applied.The company uses AWS ldentity and Access Management (IAM) to manage all users in the company. The company has assigned all users to IAM groups that have the required permissions to perform the tasks assigned to each group.The company does not want IAM users to be able to perform specific actions on AWS Key Management Service (AWS KMS) keys in the AWS accounts that are in a specific OU.Which solutions will meet these requirements? (Select THREE.)

Correct Answer: A. Attach an SCP that denies the specified AWS KMS actions to the specified OU., C. Attach an IAM policy that denies the specified AWS KMS actions to the IAM groups., D. Attach a resource-based policy that denies the specified AWS KMS actions to the AWS KMS keys.

Explanation

To meet the requirement of preventing IAM users from performing specific actions on AWS Key Management Service (AWS KMS) keys in AWS accounts within a specific Organizational Unit (OU), the following three solutions are appropriate:A. Attach an SCP that denies the specified AWS KMS actions to the specified OU.Analysis: Service Control Policies (SCPs) are used to set guardrails at the organization or OU level. By attaching an SCP that explicitly denies the specified AWS KMS actions to the OU, you can prevent IAM users in accounts within that OU from performing those actions. This approach ensures that the restrictions are applied uniformly across all accounts in the OU.C. Attach an IAM policy that denies the specified AWS KMS actions to the IAM groups.Analysis: IAM policies can be attached to IAM groups to explicitly deny specific actions. By attaching an IAM policy that denies the specified AWS KMS actions to the IAM groups that contain the users, you can prevent those users from performing those actions, regardless of the account they are in (as long as they are part of the IAM group). This provides an additional layer of security and ensures that the restrictions are enforced at the user level.D. Attach a resource-based policy that denies the specified AWS KMS actions to the AWS KMS keys.Analysis: Resource-based policies, such as KMS key policies, can be used to control access to specific AWS resources. By attaching a resource-based policy to the AWS KMS keys that explicitly denies the specified actions, you can prevent any IAM user (or principal) from performing those actions on those keys, regardless of their IAM group or account. This provides a targeted approach to restricting access to specific KMS keys.The other options are not suitable for meeting the specific requirements:B. Attach an SCP that denies the specified AWS KMS actions to the AWS KMS keys: SCPs are applied at the organization or OU level, not at the individual resource level. Therefore, you cannot attach an SCP directly to AWS KMS keys.E. Establish a trust relationship between the AWS accounts and an identity provider (IdP) to deny the specified AWS KMS actions: Establishing a trust relationship with an IdP is not a direct way to deny specific AWS KMS actions. Trust relationships are typically used for authentication and authorization purposes, not for denying specific actions on AWS resources.F. Use AWS Identity and Access Management Access Analyzer to validate the permissions of the IAM policies that are attached to the IAM groups: While AWS IAM Access Analyzer is a useful tool for validating and analyzing IAM policies, it does not directly prevent IAM users from performing specific actions. It is more of a monitoring and auditing tool rather than a preventive control.