AWS Certified Sysops Administrator Associate · Free Practice Question Medium
Question 18
A company wishes to restrict the ability to launch specific instance types to specific teams. The company has separate AWS accounts for its development and production teams and uses federated login with single sign-on (SSO). The AWS accounts are both under one organization in AWS Organizations.
How can a SysOps Administrator restrict users in the development team’s account so they can only launch T2 instances in the us-east-1 Region? (Select TWO.)
-
A
Create a service control policy (SCP) to deny instance launches unless the instance type is T2 and apply it to the developer organizational unit (OU).
-
B
Create a developer IAM group inside the production team account and attach an IAM policy to allow EC2 T2 instances.
-
C
Create a developer IAM role inside the development team account with an IAM policy to allow EC2 T2 instances.
-
D
Create a service control policy (SCP) to deny instance launches unless the instance type is T2 and apply it to the root.
-
E
Create a developer IAM group inside the development team account with an IAM policy to allow EC2 T2 instances.
Reveal correct answers
Correct answers: A, C
Explanation
AWS SSO seamlessly leverages IAM permissions and policies for federated users and roles to help you manage federated access centrally across all AWS accounts in your AWS Organization.
There are two elements to implementing this restriction. Firstly, you can restrict the ability to launch only T2 instances using a service control policy (SCP) in AWS Organizations. The SCP is applied to an OU.
With the example SCP below, any instance launches not using the t2.micro instance type are denied.
The next step is to provide the permissions required. The company is using federated login with AWS SSO. In this setup, the process results in using the AssumeRole* API actions to assume an IAM role that has a permissions policy attached granting the necessary permissions.
CORRECT: "Create a developer IAM role inside the development team account with an IAM policy to allow EC2 T2 instances" is correct.
CORRECT: "Create a service control policy (SCP) to deny instance launches unless the instance type is T2 and apply it to the developer organizational unit (OU)" is also a correct answer.
INCORRECT: "Create a developer IAM group inside the production team account and attach an IAM policy to allow EC2 T2 instances" is incorrect. This does not provide the permissions the development team need within the developer account.
INCORRECT: "Create a developer IAM group inside the development team account with an IAM policy to allow EC2 T2 instances" is incorrect. An IAM role should be used as the identities are coming from a federated source and will use AssumeRole* API actions.
INCORRECT: "Create a service control policy (SCP) to deny instance launches unless the instance type is T2 and apply it to the root" is incorrect. This would restrict the ability to launch only T2 instance types to the entire AWS Organization. The SCP should be applied to the relevant OU instead.
References:
https://docs.aws.amazon.com/organizations/latest/userguide/orgs_getting-started_concepts.html
Save time with our AWS cheat sheets:
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
