Every application in a company's portfolio has a separate AWS account for development and production. The security team wants to prevent the root user and all IAM users in the production accounts from accessing a specific set of unneeded services. How can they control this functionality?
Please select:

Question

Every application in a company's portfolio has a separate AWS account for development and production. The security team wants to prevent the root user and all IAM users in the production accounts from accessing a specific set of unneeded services. How can they control this functionality?

Please select:

Tiziano Riezzo · Accepted Answer

Create a Service Control Policy that denies access to the services. Assemble all production accounts in an organizational unit. Apply the policy to that organizational unit.

Tiziano Riezzo · Answer

Create a Service Control Policy that denies access to the services. Apply the policy to the root account.

Tiziano Riezzo · Answer

Create an IAM policy that denies access to the services. Associate the policy with an IAM group and enlist all users and the root users in this group.

Tiziano Riezzo · Answer

Create an IAM policy that denies access to the services. Create a Config Rule that checks that all users have the policy m assigned. Trigger a Lambda function that adds the policy when found missing.

Question list

List of questions

Question 1

(0)

Question 2

(0)

Question 3

(0)

Question 4

(0)

Question 5

(0)

Question 6

(0)

Question 7

(0)

Question 8

(0)

Question 9

(0)

Question 10

(0)

Related questions

Question 276 - SCS-C01 discussion

Suggested answer: A

0 comments