Organizations

Question 1

Structure and Accounts

Best Practice for security in Orgs?

Answer 1

Create all IAM Users in one acct with no other resources. Assume roles into other accts.

Question 2

Structure and Accounts

So what’s the OU at the top of the tree?

Answer 2

Trick question. Technically, none. The “Organization Root” is the top container. OUs are below this.

Question 3

Structure and Accounts

Best practice: what should you create in the Management account?

Answer 3

Nothing – it’s too powerful and can affect the whole tree.

Question 4

Roles and Users

Best practice for users in an Org?

Answer 4

Federate from on-prem to one acct, that acct has users/roles, xacct roles to all other accounts

Question 5

SCPs

What’s a Service Control Policy?

Answer 5

Policy on an OU or acct. Limits everything in that OU or acct.

Question 6

SCPs

Where else are SCPs?

Answer 6

Nowhere. This is a feature of Organizations.

Question 7

SCPs

Where can you attach SCPs?

Answer 7

Entire Org, one OU (and subtree), one account

Question 8

SCPs

What do SCPs apply to?

Answer 8

The account they attached to, all accounts in the OU, never the Management account.

Question 9

SCPs

Can an SCP restrict a root user in an AWS account.

Answer 9

YES. SCPs control what the /account/ can do. All identities including root user are under this.

Question 10

SCPs

SCP grants a permission, Session and identity don’t deny it. What happens?

Answer 10

Trick! SCPs don’t grant anything, they set the boundary of what is allowed to be granted.

Question 11

SCPs

Can SCPs at multiple levels of the OU tree exist?

Answer 11

Yes: inherit DOWN the tree.

Question 12

SCPs

Why generally don’t we create resources in the Management account?

Answer 12

It can’t be controlled by SCPs.

Question 13

SCPs

Example of SCPs?

Answer 13

Can’t deploy in any region other then us-east-1; allowlist only certain EC2 instance types.

Question 14

SCPs

What is the default SCP before you add anything of your own?

Answer 14

Full access to everything. (not granting anything, just setting the limits to “no limits”).

Question 15

SCPs

How do you create a SCP to only allow us-east-1?

Answer 15

Default is allow all, so create a deny for all regions other than us-east-1.

Question 16

SCPs

How do you use SCPs to set up an Allowlist structure?

Answer 16

Delete the default FullAWSAccess SCP, resulting in “Implicit Deny”. Add specific SCPs to allow.

Question 17

SCPs

How do you set up DenyList structure in SCPs?

Answer 17

Remove the default FullAWSAccess leaving “implicit deny” in place

Question 18

SCPs

Which is lower admin overhead: allowlist or denylist?

Answer 18

Denylist: as new services are added to AWS, they are allowed by default.

Question 19

SCPs

Can an account view the SCPs applied to it?

Answer 19

Yup!