A library consortium must prevent member libraries' accounts from disabling CloudTrail or creating unrestricted IAM admin users, while still detecting risky configurations. Which design best combines preventive and detective controls?
Select an answer to reveal the explanation.
Short Explanation
SCPs are the deadbolts on every branch library door; Config and GuardDuty are the security cameras. Lock out “turn off the trail” and “make a super-admin,” then keep detective services watching. Hope, shared root passwords, or deleting CloudTrail on purpose are how consortia get burned.
Full Explanation
Preventing member libraries from disabling CloudTrail or creating unrestricted IAM admin users, while still detecting risky configurations, combines Organizations service control policies with detective services. SCPs deny cloudtrail:StopLogging/DeleteTrail-style actions and block creation of unbounded admin users or dangerous policy attachments as preventive guardrails. AWS Config and GuardDuty (and related Security Hub aggregation) then detect residual misconfigurations and threats the SCP did not fully express. Preventive plus detective is the professional pairing for a consortium landing zone.
Allowing full AdministratorAccess everywhere and relying on invoice reviews provides neither prevention nor timely detection. Deleting CloudTrail so it “cannot be misconfigured” removes auditing; using IAM users without MFA worsens identity risk. Sharing one root password across library accounts with verbal approval before IAM changes fails every accountability and MFA expectation.
Exam caveat: SCPs are preventive guardrails on accounts in an Organization; they do not grant permissions—they limit the maximum permissions IAM can allow—and they must be paired with detective services for residual risk. Operational check: attach the deny-CloudTrail-stop and deny-unrestricted-admin SCPs to the libraries OU, attempt StopLogging from a member admin and expect failure, confirm Config/GuardDuty remain enabled, and review Security Hub for noncompliant rules.