Legit SCS-C02 Exam Download

Use AWS Systems Manager Session Manager:

AWS Systems Manager Session Manager provides a secure way to access Amazon EC2 instances without requiring SSH keys, opening inbound ports, or maintaining bastion hosts.

This complies with the company's requirement of not managing SSH keys or maintaining bastion hosts.

Configure Session Manager Logging to CloudWatch:

In the Systems Manager Console, configure Session Manager to upload session logs to Amazon CloudWatch Logs.

This ensures all session activity logs are recorded and stored securely.

Encrypt Logs in CloudWatch:

Use an AWS Key Management Service (AWS KMS) key to encrypt the logs in CloudWatch Logs. Ensure that the CloudWatch log group is configured to use an encrypted KMS key.

This meets the requirement to encrypt logs.

Monitor Logs for Compliance and Security:

Monitor the CloudWatch Logs to ensure proper access and record all activity for compliance purposes.

AWS Systems Manager Session Manager Documentation

Encrypting CloudWatch Logs with KMS

AWS Best Practices for Accessing EC2 Instances

Users in member accounts will not have sufficient permissions to delete the organization trail, turn logging on or off, change what types of events are logged, or otherwise alter the organization trail in any

Set Up AWS Client VPN:

Deploy a Client VPN endpoint in the region where the VPCs are located.

Authorization Rule:

Configure the VPN endpoint with authorization rules to allow access only to the specific VPC subnets that the consultant needs.

VPC Peering Consideration:

Ensure routing between the peered VPCs is correctly configured to allow traffic from the Client VPN endpoint.

Advantages:

Secure Access: Provides encrypted access to the VPCs.

Granular Control: Restricts access to only required resources.

AWS Client VPN Documentation

Authorization Rules for Client VPN

Comprehensive and Detailed Explanation From Exact Extract:

Service Control Policies (SCPs) are applied at the AWS Organizations level to manage what permissions are available across accounts. SCPs do not grant permissions themselves but restrict them.

In this case, the existing SCP denies resource sharing with external accounts across the organization. To allow an exception for the marketing team, the correct solution is to edit the existing SCP and apply a Condition that excludes the marketing team’s account. This is typically done using the StringNotEquals condition with the aws:PrincipalAccount or aws:PrincipalOrgID key.

By using a condition statement, you can tailor the SCP to deny access only to accounts other than the marketing account. This method ensures granular control without having to restructure the Organizational Unit (OU) or write an entirely separate policy.

Reference from AWS Certified Security - Specialty Official Guide:

This scenario is covered under the Identity and Access Management domain, where SCP exceptions and conditions are used to precisely control permission inheritance across accounts in an organization.