Question 36
Domain 6: Security and ComplianceA company manages environments for its application in multiple AWS accounts. Each environment account is in a different OU in AWS Organizations. A DevOps team is responsible for the application deployment process across the environments. The deployment process uses an AWS CodePipeline pipeline in a Shared Services account. The DevOps team members are in the same user group. The team members have administrative access to all accounts through AWS IAM Identity Center. A recent deployment problem in the development environment required the DevOps team to perform manual steps. The deployment to the production environment then resulted in an incident that caused the pipeline to fail, which blocked new deployments for several hours. A DevOps engineer needs to ensure that only the pipeline can perform deployments in the production environment. The DevOps engineer must have access to the environment in case of an emergency. Which solution will meet these requirements with the MOST operational efficiency?
Correct answer: A
Explanation
An SCP can enforce account-wide guardrails because it applies to all principals in the account, so “a deny” on resource modification by any entity other than the pipeline role ensures only the pipeline can deploy in production. Giving the DevOps group “ReadOnlyAccess” limits routine access, while a separate admin permission set for the engineer preserves emergency access and the ability to “assume the pipeline role” when needed.
Why each option is right or wrong
A. Update the DevOps group to have the ReadOnlyAccess permission set for the production accounts. Configure the DevOps engineer user with a new permission set that has AdministratorAccess permissions and that allows the user to assume the pipeline role. Add an SCP that denies modification of resources by any entity other than the pipeline role.
Under AWS Organizations, an SCP attached to the production account’s OU can set the maximum permissions for every principal in that account, including IAM Identity Center users and roles; explicit denies in an SCP override any identity-based allow. By denying write actions on production resources to all principals except the CodePipeline service role, the account is protected even if a user has broader permissions, while the engineer’s separate AdministratorAccess permission set preserves break-glass access for emergencies and the ability to assume the pipeline role when needed.
B. Create an SCP that denies all write actions for the DevOps team members on the production OU. Configure a new user in IAM Identity Center for the DevOps engineer with a new permission set that has AdministratorAccess permissions. Add an SCP that denies modification of resources by any entity other than the pipeline role.
Creating a separate user is unnecessary overhead; emergency access can be handled with a dedicated permission set.
C. Update the DevOps group to be able to assume the pipeline role for the production accounts. Configure a new user in IAM Identity Center for the DevOps engineer with a new permission set that has AdministratorAccess permissions. Add an SCP that denies modification of resources by any entity other than the DevOps engineer.
Denying everyone except the engineer defeats the requirement that only the pipeline performs production deployments.
D. Create an SCP that denies all write actions for the DevOps team members on the production OU. Use a specific tag to tag the resources that CodePipeline provisions. Add an SCP that denies modification of tagged resources by any entity other than the DevOps engineer.
Tag-based protection is incomplete and operationally fragile compared with directly restricting all production modifications to the pipeline role.