Exam AWS Certified Solutions Architect - Professional All Questions

View all questions & answers for the AWS Certified Solutions Architect - Professional exam

Exam AWS Certified Solutions Architect - Professional topic 1 question 784 discussion

Exam question from Amazon's AWS Certified Solutions Architect - Professional

Question #: 784
Topic #: 1

[All AWS Certified Solutions Architect - Professional Questions]

A company has a large number of AWS accounts in an organization in AWS Organizations. A different business group owns each account. All the AWS accounts are bound by legal compliance requirements that restrict all operations outside the eu-west-2 Region.
The company's security team has mandated the use of AWS Systems Manager Session Manager across all AWS accounts.
Which solution should a solutions architect recommend to meet these requirements?

A. Create an SCP that denies access to all requests that do not target eu-west-2. Use the NotAction element to exempt global services from the restriction. In AWS Organizations, apply the SCP to the root of the organization.
B. Create an SCP that denies access to all requests that do not target eu-west-2. Use the NotAction element to exempt global services from the restriction. For each AWS account, use the AmNotLike condition key to add the ARN of the IAM role that is associated with the Session Manager instance profile to the condition element of the SCP. In AWS Organizations apply, the SCP to the root of the organization.
C. Create an SCP that denies access to all requests that do not target eu-west-2. Use the NotAction element to exempt global services from the restriction. In AWS Organizations, apply the SCP to the root of the organization. In each AWS account, create an IAM permissions boundary that allows access to the IAM role that is associated with the Session Manager instance profile.
D. For each AWS account, create an IAM permissions boundary that denies access to all requests that do not target eu-west-2. For each AWS account, apply the permissions boundary to the IAM role that is associated with the Session Manager instance profile.

Show Suggested Answer

Suggested Answer: A 🗳️

by GeniusMikeLiu at Jan. 19, 2022, 2:38 p.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

[Removed]

2 years, 4 months ago

Selected Answer: A

sat on this one for a while but i think ill settle for A. if you want to exclude regions you can use the SCP however some services a global resources so you use the Notaction to exempt the global services. If you want to allow roles to bypass the policy you can use the ArnNotLike and exclude certain admin roles from the SCP policy. This is NOT what we want to achieve, the goal is to block access to other regions, hence the System Manager roles should not be exempt. Where i'm slightly confused is how are we mandating the use of SSM? Users will be able to use any services within EU-WEST-2 including SSM.

upvoted 2 times

...

andras

2 years, 4 months ago

Selected Answer: B

Session Manager does not support cross-account access. You will need to assume a Role in account B (for example, from your user/role in account A) before starting the session. ... it seems to be B...

upvoted 1 times

...

mrgreatness

2 years, 7 months ago

A for me, does what is asked

upvoted 1 times

...

SureNot

2 years, 7 months ago

Selected Answer: A

Choosing between A and B.. Can't see a condition or any reason SSM should AVOID region restriction - so A.

upvoted 2 times

...

nsvijay04b1

2 years, 8 months ago

Selected Answer: B

A) SSM not handled. B) region + SSM handled in SCP at root level ( ques says 'mandated') C) region handled at root with SCP + SSM left for accounts to handle( not 'mandated') and permission boundary cannot give perm if SCP denies it D) not at all centrally managed , needs SCP

upvoted 2 times

...

asfsdfsdf

2 years, 11 months ago

Selected Answer: A

D will not work for sure - its applied to session manager only C will not work also its aagain applied to SSM profile and it will not grant access its either A or B - for B it means we will allow the SSM ARN role to work on all regions only A left as the correct option - it will deny access to all regions with exception of eu-west-2 no need to do anything else as SSM is already allowed by SCP by default A - means we deny all access to other regions -

upvoted 2 times

asfsdfsdf

2 years, 11 months ago

if question was stated the The company's security team has required that all AWS accounts utilize AWS Systems Manager Session Manager on all regions - I would choose B

upvoted 1 times

...

Ddssssss

3 years ago

Its not B because that would apply the SCP for all users except The session manager IAM which would allow that account to do whatever it wants. I would say "D", why cant a simple permissions boundary simply deny access for sessions manager to all other regions? Why does it need an SCP?

upvoted 1 times

...

DLML

3 years, 3 months ago

I am not too convinced with C nor A. How about B? SCP will have deny to run EC2 with condition ArnNotLike the session-manager-profile-role

upvoted 3 times

...

Alexey79

3 years, 4 months ago

It's C. 1. Create SCP policy to privent denies access to any operations outside of the specified Region. https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps_examples_general.html#example-scp-deny-region 2. Create IAM Policy in each account from making certain changes https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html “ security team has required that all AWS accounts utilize AWS Systems Manager Session Manager “ IAM must be configured to allow access.

upvoted 2 times