Simulated Multi-Account Governance

Real multi-account strategies rely on AWS Organizations SCPs, OU hierarchies, and delegated administrator services. But you cannot spin up an Organization in a lab account. Instead, this lab simulates the essential governance patterns using IAM roles, permission boundaries, CloudFormation guardrail templates, and delegated-administrator role modeling -- all inside a single account.

You will:

• Create 3 IAM roles representing different OU personas (SecurityAuditRole, DevOpsAdminRole, ReadOnlyViewerRole) with appropriate managed policies and trust relationships
• Author and attach a permission boundary that simulates an SCP: restrict EC2 instance types, deny IAM privilege escalation, deny S3 bucket deletion without MFA
• Deploy a CloudFormation guardrail template that encodes infrastructure-as-governance (S3 bucket policy requiring SSE-S3 encryption)
• Configure the delegated administrator pattern with a role trusted by an AWS service and a CloudTrail trail delivering to a governance S3 bucket
• Run scenario-based verification checks and write findings to a governance report

Every resource is tagged lab=true, Course=dop-c02. Name suffixes use $RANDOM for uniqueness.