Certbie
Question 1 of 30
In a large enterprise utilizing AWS Organizations, the security team is tasked with implementing a policy that restricts the creation of new IAM users across all accounts within the organization. The organization has multiple Organizational Units (OUs) for different departments, and the security team wants to ensure that this policy is applied uniformly. Which approach should the security team take to achieve this goal effectively while maintaining flexibility for specific departments that may require exceptions?
Create a Service Control Policy (SCP) that denies the `iam:CreateUser` action and attach it to the root of the organization, while allowing specific OUs to have exceptions through additional SCPs that permit the action.
Implement an IAM policy at the account level that denies the `iam:CreateUser` action for all users in the organization, ensuring that no new users can be created.
Use AWS Config rules to monitor the creation of IAM users and alert the security team whenever a new user is created, allowing them to take manual action afterward.
Set up CloudTrail logging to track IAM user creation events and create a Lambda function that automatically deletes any newly created users across the organization.

Preparing for Amazon SAP-C02 AWS Certified Solutions Architect – Professional (SAP-C02)? Now land the interview.

73% of qualified candidates get rejected because of weak resumes. Build an ATS-optimized, recruiter-ready resume in under 5 minutes - free to start.

Build My Resume Free