AWS Orgnizations & Accounts

Question 1

Can I have one or more organization master account?

Answer 1

No, each orgnization has one master account and this account.

Question 2

If I set a policy at the master account, how will this policy be applied to all other accounts in the orgnization?

Answer 2

The policy is been set at the highest point in the organizational structure and as such will be applied ot all other accounts.

Question 3

What two modes do organisation have an available?

Answer 3

• Consolidated billing

- All Features

Question 4

Why would I use consolidated billing?

Answer 4

• You get to avail of the volume discounts

- One bill for all accounts

Question 5

I have several accounts as part of my organization, I want too easily logging to each account without having to log out of the main org account as I also do not know what the root user of each account is, how cna I do this?

Answer 5

When you create these new sub-accounts, you have to select an IAM role name, this IAM ROLE is used to grant admin access to the account so you can switch to the account. This role has a trust relationship with the org account and permissions of the administrator.

Question 6

I am creating a new account as part of my organization account, I want to allow this account only have access to S3 service, how cna I do this?

Answer 6

Use organizational policies to disable the services

Question 7

What is a service control policy?

Answer 7

It enables you to control what services in an account can be accessed.

Question 8

Will a service control policy have any effect on a master account?

Answer 8

No

Question 9

Do service control policies grant you to use services?

Answer 9

No, you have to have the permission in a normal user or resource policy and the service control policy to get access.

Question 10

What is a service limit in an aws account?

Answer 10

It iis a limit put on a resource, like the number of EIPs, you can request top have limits increased.

Question 11

I am designing a solution that enables my user access AWS console, I will have 10K users, what is the best approach?

Answer 11

AWS accounts have a 5K limit so you will have to use a federation approach with SAML. This is where you will use SAML with an IP like ASD federation.

Question 12

In a multi-account approach for AWS, what is the publishing account used for?

Answer 12

This is where you put all you AMI’s and centrally manage them.

Question 13

In a multi-account approach for AWS, what is the logging account used for?

Answer 13

It is the one account/place where all logging are stored and managed for every account.

Question 14

In a multi-account approach for AWS, I need to set up IAM for the multiple accounts, how cna I do this?

Answer 14

You are going to create a role in the accounts and in the IAM account, you are going to manage your users but creating a group and giving them the permission to assume the role created in the other accounts.

Question 15

What are the organizations account structure you should use to provide separation of concerns?

Answer 15

B.I.L.P

• Billing (Master billing account)
• Identity account (Central IAM account)
• Logging account (All the logs into this account)
• Publishing account (Service catalogue, EC2 AMI)

Question 16

How should I arrange IAM for an Organization?

Answer 16

One separate account for IAM management and cross-account IAM roles in other accounts or Federation.

Question 17

When using Organizations how should we arrange to the logs of each of the account?

Answer 17

Creat on account for logging, feed all logs form all other accounts to this account, you can do this by selecting apply trail to all accounts when creating a cloud trail in cloud watch logs.

Question 18

I what my Organization logging account to capture VPC flow logs, what are my options?

Answer 18

You can set up VPC flow logs to send data to CloudWatch

Question 19

I want to ensure that I have a centralized way to manage AMI & Service Catalogue, what are my options?

Answer 19

Create a publishing account and use this account for central management of AMI or

Question 20

What are the primary features of Organizations?

Answer 20

• Account management
  Consolidated billing
• Policy-based management

Question 21

Are tags supported in organizations?

Answer 21

Yes

Question 22

What are the three key functions of an AWS account?

Answer 22

• Authentication
• Authorization
• Billing

Question 23

When you create a new AWS account,what is the default user?

Answer 23

• Root user

Question 24

What is principal, authenticate and authorize?

Answer 24

Principal: Who was authenticated and is authorized/or not.

Question 25

How can a principal authenticate with AWS?

Answer 25

A principal can use, - user name/password - key pairs

Question 26

What are the two functions stores provided by IAM?

Answer 26

- Identity store | - Access store

Question 27

Do service control policies give you access to services?

Answer 27

No, you can only deny access

Question 28

Is the default of a service control policy a deny or allow?

Answer 28

Deny, to allow you have to explicitly call it our in the policy.

Question 29

If there is an explicit Deny, and also an explicit Allow, will that Allow win and you will be able to use the service?

Answer 29

No, the explicit Deny will win and you will be denied access.

Question 30

Why would you use orgnizations?

Answer 30

- Consolidated billing - Centralized account management - Tagging policies - Hierarchical grouping of your accounts to meet your budgetary, security, or compliance need - Adds a higher level to IAM, where you can control the services available on the accounts, even the root user of the account.

Question 31

I am having trouble with developer adding tags that are formatted differently between the developer, I am also using Orgnizations, how cna I fix this?

Answer 31

Create a Tagging policy and add to the orgnization, with the tagging policy you can enforce tags and format.

Question 32

Are you charged for tagging policies?

Answer 32

No

Question 33

Can I add Tags to users and roles?

Answer 33

Yes 100%

Question 34

Are most resources in AWS allowing tags?

Answer 34

Yes most all resources in AWS allow tags

Question 35

I have developers gone wild creating tags everywhere and in many different formats, how solve this, explain the steps?

Answer 35

- In orgnizations, you will have to enable tag policies in the setting - Create a tag policy in the orgnizations. - Attach the Tag Policy to the root, account, OU

Question 36

How cna I enforce resource to not be created if they are not tagged correctly?

Answer 36

Use a tagging policy, select enforce no

Question 37

I wnat to know what Tages are not compliant, is this possible?

Answer 37

Yes, there is a feature to see non-compliant tagging report.

Question 38

Is orgnization a regional service?

Answer 38

No, it is a global service like IAM

Question 39

Does organizations operate a eventual consistent model?

Answer 39

Yes, 100%, all data is not sync but is eventually consistent.

Question 40

What is the cost of Orgnizations?

Answer 40

No charge, like IAM

Question 41

Can you delete the orgnization, explain?

Answer 41

Yes, remove accounts and also remove the master account by deleting the orgnization.

Question 42

I want to monitor changes in my Orgnization, and send an email to me when changes happen, how can I do this?

Answer 42

You use CloudWatch Events (cloud trail selector) to trigger an SNS message to be sent by email to the subscriber.

Question 43

I want to monitor changes in my Orgnization, and have an entry put in DynamoDB for each change, how can I do this?

Answer 43

You can use Cloudwatch events (cloud trail selector) to trigger a lambda function thet can write an entry in DynamoDB

Question 44

What is enable All Features?

Answer 44

It enables all features of orgnizations like consolidated billing, tagging policies, service control policies.

Question 45

I have Resource Manager and I wnat to enable this service in my Orgnization, explain how I do this?

Answer 45

You enable this service in the setting of the orgnization, what you are doing is enabling this service as a trusted service of the orgnization. This means the service can create service linked roles on all the accounts in your organization