A company is running multiple workloads in the AWS Cloud. The company has separate units for software development. The company uses AWS Organizations and federation with SAML to give permissions to developers to manage resources in their AWS accounts. The development units each deploy their production workloads into a common production account. Recently, an incident occurred in the production account in which members of a development unit terminated an EC2 instance that belonged to a different development unit. A solutions architect must create a solution that prevents a similar incident from happening in the future. The solution also must allow developers the possibility to manage the instances used for their workloads. Which strategy will meet these requirements?
Select one answer.
Marked answer: B
Community Discussion
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
1
B is right The goal is to prevent developers from managing resources in another development unit's account, but still allow them to manage their own instances. By passing an attribute for DevelopmentUnit as an AWS Security Token Service (AWS STS) session tag during SAML federation, you can filter the IAM policies assigned to the developers' assumed IAM roles based on their own development unit name. Updating the IAM policy with a deny action and a StringNotEquals condition for the DevelopmentUnit resource tag and aws:PrincipalTag/DevelopmentUnit ensures that developers cannot manage resources in another development unit's account. This approach also allows developers to manage their own instances, as long as they are not trying to access resources from another development unit.
Chose B4
Option A will not work for common Production Account.
6
Answer: B Option A: While OUs and SCPs can provide access control, they are more suitable for broader permission boundaries and might not offer the same granularity as STS session tags and IAM policies.
