DOP-C02 practice question: Cross-account roles and SCPs
Configuration Management and IaC A free question from our original DOP-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.
A SaaS startup runs 25 AWS accounts in an AWS Organization. Its developers build serverless applications in development accounts, and they create IAM roles for their Lambda functions in those accounts.
A recent incident showed that a developer role could create a role with broad permissions, and another role could stop CloudTrail logging. The security team wants both risks blocked for every member account, including developers with full IAM access in their own accounts.
Developers must still be able to create roles for their functions, but only when each role carries the company's approved permissions boundary, and the controls must not depend on each account being configured correctly.
Which TWO actions meet these requirements? (Choose two.)
Choose two answers.
AA. Attach an IAM policy to each developer role in every account that allows iam:CreateRole only when the permissions boundary is set to the approved policy.
BB. Attach a service control policy to the development organizational unit that denies iam:CreateRole unless the iam:PermissionsBoundary condition key equals the approved boundary policy ARN.
CC. Attach a service control policy to the organization root that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail for all member accounts, except for the security audit role.
DD. Give the developers' roles a permissions boundary that denies CloudTrail changes, and rely on the boundary to stop logging changes by any role that the developers create.
EE. Enable AWS Config rules that detect new roles without the boundary and CloudTrail changes, and alert the security team, so that problems are found soon after they happen.
B. Right: Correct. A service control policy applies to every principal in the member accounts, including account administrators, so the boundary requirement cannot be bypassed locally. The policy uses the condition key to check the boundary on each role creation. Learn more: Service control policies (SCPs) (opens in a new tab)
C. Right: Correct. The SCP stops member accounts from disabling or deleting their trails, which holds even for administrators in those accounts. The security audit role is excluded so that the security team keeps its own access. Learn more: SCP evaluation (opens in a new tab)
D. Wrong: A permissions boundary limits the permissions of one role and does not restrict other principals, so roles created without the boundary would be unaffected. The boundary also does not apply to the account's root user. Learn more: Permissions boundaries for IAM entities (opens in a new tab)
Service control policies apply to every principal in member accounts, so they can require a permissions boundary on new roles and block changes to CloudTrail regardless of local IAM settings. Account-level policies depend on each account being set up correctly, while permissions boundaries and detective rules do not block the actions the security team cares about.
Want more on Cross-account roles and SCPs? The 5 full-length practice sets have 4 more Cross-account roles and SCPs questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →