1.2 - Multi-account security and shared services (inspection VPC, RAM, Managed AD, OIDC)
AWS Solutions Architect Professional objective 1.2 covers centralizing security and shared services for many accounts. You inspect traffic from dozens of VPCs through one central inspection VPC, using a Gateway Load Balancer with third-party appliances or AWS Network Firewall with centrally managed stateful rules, all reached via Transit Gateway. You defeat the confused-deputy problem by requiring a unique external ID on cross-account AssumeRole, and protect a central log-archive bucket with S3 Object Lock in compliance mode plus an SCP that denies deletion. AWS Resource Access Manager shares subnets and resources to accounts or OUs without invitations, AWS Managed Microsoft AD provides real Active Directory with Group Policy and trusts, and Route 53 Resolver DNS Firewall blocks malicious domains org-wide. A pipeline deploys without long-lived keys by federating through an IAM OIDC provider and conditioning AssumeRoleWithWebIdentity on the repository claim. Expect scenarios about centralized inspection, tamper-proof logs, or keyless CI/CD, and ask which security design fits.
Inspect all VPC traffic in one place = central inspection VPC (GWLB or Network Firewall) via Transit Gateway. Third-party assumes your role safely = require a unique external ID. CI/CD with no stored keys = IAM OIDC provider + AssumeRoleWithWebIdentity.
Practice questions
1. Auditors require that developers can create IAM roles but can never grant those roles more permissions than a defined ceiling, even by mistake. What enforces the ceiling on roles they create?
- An SCP on the developers' account that denies iam:CreateRole
- A resource-based policy attached to each new role automatically
- A permissions boundary that developers must attach to every role they create (correct answer)
- An IAM group that the new roles are added to at creation time
A permissions boundary caps the effective permissions of a role; you require (via a condition on iam:CreateRole) that developers attach the boundary, so roles can never exceed it. Denying CreateRole stops delegation entirely, and groups apply to users, not roles.
2. A security team wants all outbound internet traffic from dozens of VPCs to pass through one inspection point running third-party firewall appliances, with traffic transparently steered there. Which design fits?
- An interface endpoint per VPC pointing at the firewall vendor's management API for policy sync
- Individual NAT gateways deployed in every single VPC combined with verbose security group logging
- A central inspection VPC with a Gateway Load Balancer and appliances, reached via Transit Gateway (correct answer)
- A public virtual interface on Direct Connect routing all of the egress to the data center firewall
A Gateway Load Balancer transparently distributes traffic to a fleet of firewall appliances using GENEVE encapsulation; placing it in a central inspection VPC and routing spoke VPC egress there through Transit Gateway inspects all outbound traffic in one place. Per-VPC NAT gateways skip appliance inspection, interface endpoints target services not arbitrary firewalls, and a public VIF is for reaching AWS public endpoints.
3. An architect must ensure an S3 interface endpoint is used only by principals in the organization and only for two specific buckets. Which control expresses these restrictions on the endpoint?
- A security group on the endpoint that lists each of the allowed buckets explicitly by their names
- A network ACL that restricts the endpoint's whole subnet down to the published S3 service IP ranges
- An SCP attached directly onto the endpoint's elastic network interface to constrain the callers
- A VPC endpoint policy allowing only those principals and bucket ARNs (correct answer)
A VPC endpoint policy is a resource policy on the endpoint that can scope allowed principals, actions, and resource ARNs, so it can limit use to the org and to two bucket ARNs. Security groups and NACLs filter by IP/port not by bucket or principal, and SCPs attach to accounts and OUs, not to network interfaces.
4. A compliance rule requires blocking DNS resolution of known malicious domains for all queries made from several VPCs, centrally managed. Which service should the architect deploy?
- Network ACLs that deny outbound UDP port 53 on every subnet across all of the affected VPCs
- AWS WAF rules that inspect requests and match against the list of known malicious domain names
- Route 53 Resolver DNS Firewall rule groups shared to the VPCs (correct answer)
- Security groups referencing a centrally managed prefix list containing the malicious server IPs
Route 53 Resolver DNS Firewall filters outbound DNS queries against domain rule groups and can be associated with (and shared to) many VPCs for central management. Blocking port 53 breaks all DNS, WAF inspects HTTP(S) not DNS, and prefix lists of IPs do not match domain names in DNS queries.
5. Regulators require that traffic over an existing Direct Connect private VIF be encrypted in transit, but a private VIF alone carries plaintext. Which TWO approaches can add encryption over Direct Connect? (Choose TWO.)
- Run an IPsec Site-to-Site VPN over a Direct Connect public VIF (correct answer)
- Switch the private VIF over to a public VIF so that AWS then encrypts all of its traffic automatically
- Enable Amazon S3 server-side encryption on each of the VPC endpoints that sit along the traffic path
- Enable MACsec on a supported Direct Connect port and device (correct answer)
Two patterns encrypt DX traffic: an IPsec Site-to-Site VPN over a public VIF gives an encrypted tunnel across the DX path, and MACsec provides Layer 2 encryption on supported Direct Connect ports and devices. A public VIF is not automatically encrypted, and S3 server-side encryption protects data at rest, not the DX link in transit.
6. An architect wants to guarantee that member accounts cannot create internet gateways or delete the shared transit gateway attachments, regardless of any IAM permissions granted locally. What enforces this at the organization level?
- A permissions boundary attached onto each account's own networking administration role individually
- A service control policy denying those actions on the OUs (correct answer)
- A VPC endpoint policy written to restrict which network-related API calls may traverse the endpoints
- A RAM resource share that limits exactly which member accounts are able to view the transit gateway
An SCP applied to the OUs sets a permission ceiling that denies ec2:CreateInternetGateway and the delete-attachment actions for every principal in those accounts, overriding any local IAM allow. Permissions boundaries only cap specific principals you attach them to, endpoint policies scope endpoint traffic, and RAM controls sharing not action denial.