Multi-account governance and auditing: SAA-C03 study notes and practice questions
What to know about Multi-account governance and auditing for the SAA-C03 exam, from the Design Secure Architectures domain (30% of the exam guide), then 2 free questions to test it. Part of the SAA-C03 study guide.
Multi-account questions describe a company with many AWS accounts that needs consistent rules, central logs or central billing. The answers live in AWS Organizations and the services that plug into it.
Key facts
Service control policies (SCPs) set the maximum permissions for every user and role in member accounts, including account administrators and the root user of those accounts. They don’t affect the management account, and they never grant permissions on their own.
Common SCP patterns: deny all actions outside approved Regions (with the aws:RequestedRegion condition, exempting global services), deny turning off CloudTrail or GuardDuty, deny leaving the organization.
Resource control policies (RCPs) set a maximum on what can be done to resources in member accounts (for services such as S3, KMS and Secrets Manager), whoever the caller is. Use them to stop access from outside the organization.
An organization trail in CloudTrail, created from the management account or a delegated administrator, logs every account, includes new accounts automatically, and can’t be changed from member accounts. Send it to a bucket in a separate log archive account, with log file integrity validation on.
AWS Config records resource configurations and checks them against rules; conformance packs and aggregators give an organization-wide view.
AWS Control Tower sets up a landing zone (log archive and audit accounts, organization trail, guardrails) and an Account Factory for new accounts. It is the low-effort answer for “set up a secure multi-account environment”.
Consolidated billing combines usage across accounts for volume discounts, and Reserved Instance and Savings Plans discounts are shared across the organization by default.
AWS RAM shares resources such as subnets, Transit Gateways and Route 53 Resolver rules with other accounts.
How to choose
Need
Answer
Stop every account using a service or Region, even administrators
SCP
Stop anyone outside the organization reaching your S3 buckets
RCP, or aws:PrincipalOrgID in resource policies
Central, tamper-resistant audit logs for every account
Organization trail to a log archive account
Detect resources that break a rule (unencrypted volumes, open ports)
AWS Config rules
New multi-account setup with guardrails and minimal effort
AWS Control Tower
Common traps
Expecting an SCP to give access. It only limits; an IAM policy must still allow the action.
Putting the SCP on the management account. SCPs don’t apply there, so keep workloads out of it.
Using AWS Config to prevent an action. Config detects and can remediate after the fact; prevention needs an SCP or IAM policy.
A company manages 40 AWS accounts with AWS Organizations.
Data residency rules say that workloads in member accounts may run only in eu-west-2 and eu-west-1. Several teams have full administrator access in their own accounts, and the control must stop them too, before any resource is created. The teams must still be able to manage IAM roles, Amazon Route 53 records and Amazon CloudFront distributions.
Which solution meets these requirements?
Choose one answer.
AA. Attach an SCP to the root that denies requests when aws:RequestedRegion is not an approved Region, with NotAction exempting global services such as IAM.
BB. Attach an SCP to the organization root that denies every action when aws:RequestedRegion is not eu-west-2 or eu-west-1, with no exceptions.
CC. Attach a permissions boundary to every administrator role in each account that allows actions only when aws:RequestedRegion is eu-west-2 or eu-west-1.
DD. Deploy an AWS Config rule in every account and Region, with automatic remediation that deletes any resource found outside eu-west-2 and eu-west-1.
Show the answer and explanation
Answer: A
A. Right: Correct. An SCP sets the maximum permissions for every principal in member accounts, including administrators, and blocks the request before anything is created. Global services such as IAM, Route 53 and CloudFront have endpoints in us-east-1, so they are listed in NotAction to keep them working. Learn more: SCP examples: deny access to AWS based on the requested Region (opens in a new tab)
B. Wrong: This blocks other Regions for everyone, but it also blocks global services. Requests to IAM, Route 53 and CloudFront are served from us-east-1, so the teams could no longer manage roles, DNS records or distributions. The deny needs NotAction exemptions for those services. Learn more: SCP syntax (opens in a new tab)
C. Wrong: Permissions boundaries are set inside each account, so an administrator with full IAM access can remove or edit the boundary on their own role, or create new roles without it. It also has the same problem with global services. An SCP is applied from outside the account and cannot be changed by its administrators. Learn more: Permissions boundaries for IAM entities (opens in a new tab)
D. Wrong: AWS Config evaluates resources after they exist and then runs remediation, so resources would be created in other Regions for a while. It also needs recorders and rules in every Region to see them. This is a detective control, but the company needs a preventive one. Learn more: Remediating noncompliant resources with AWS Config (opens in a new tab)
Explanation
Service control policies limit what any user or role in a member account can do, even with AdministratorAccess, and they act before a request succeeds. A Region deny uses the aws:RequestedRegion condition key. Because global services such as IAM, Route 53 and CloudFront are served from us-east-1, the policy must exempt them with NotAction, or the teams lose access to them. SCPs do not affect the management account.
A bank runs 60 accounts in AWS Organizations, and new accounts are added most months.
Auditors require a record of every management API call in every account and Region, kept in one central location. Administrators of member accounts must not be able to stop or change the logging, and the bank must be able to prove later that no delivered log file was altered or removed.
Which TWO actions meet these requirements? (Choose two.)
Choose two answers.
AA. From the management account, create an all-Region organization trail that delivers logs to an S3 bucket in a dedicated log archive account.
BB. Turn on log file integrity validation for the trail, and keep the digest files in the log archive bucket together with the log files.
CC. Use CloudFormation StackSets to create a multi-Region trail in each member account that delivers to an S3 bucket in the log archive account.
DD. Turn on CloudTrail Insights for the trail so that unusual API call volumes and error rates in member accounts are flagged automatically.
EE. Rely on CloudTrail event history in each account, and have the auditors use the console to search the last 90 days of management events.
Show the answer and explanation
Answers: A, B
A. Right: Correct. An organization trail logs every member account, including accounts added later, to one bucket. Users in member accounts can see the trail but cannot delete it, turn logging off or change it. Learn more: Creating a trail for an organization (opens in a new tab)
C. Wrong: The logs would be central, but each trail belongs to its member account, so that account's administrators could stop logging or delete the trail. An organization trail cannot be changed from member accounts. Learn more: Creating a trail for an organization (opens in a new tab)
D. Wrong: Insights spots unusual patterns in API call rates and error rates. It does not stop administrators from changing logging, and it cannot prove whether log files were altered. Integrity validation does that. Learn more: Working with CloudTrail Insights (opens in a new tab)
E. Wrong: Event history is kept per account and per Region for only 90 days, so it is neither central nor a lasting record. Auditors would have to search 60 accounts one by one. An organization trail to a central bucket is needed. Learn more: Working with CloudTrail event history (opens in a new tab)
Explanation
An organization trail created from the management account (or a delegated administrator) logs every member account, adds new accounts automatically, and cannot be changed from member accounts. Log file integrity validation adds signed digest files so you can prove whether any log file was modified or deleted after delivery.
The organization trail adds new accounts automatically, and digest files in the log archive prove the logs are unchanged.
Want more on Multi-account governance and auditing? The 5 full-length practice sets have 9 more Multi-account governance and auditing questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →