How would you secure a growing multi-account AWS organization to limit blast radius?
What they are really testing: Senior signal: thinking in terms of isolation, guardrails, and centralized governance rather than per-resource fixes. They want org-level structure, not "use IAM".
A real interview question
How would you secure a growing multi-account AWS organization to limit blast radius?
What most people say
drag me
“I would set up IAM roles and policies carefully in the account and enable MFA.”
Per-account IAM is necessary but not the answer to multi-account governance. It misses the structural controls, account separation, SCP guardrails, centralized logging, landing zone, that actually contain blast radius at scale.
The follow-ups they ask next
What can an SCP do that account-level IAM cannot?
An SCP sets a permission ceiling across accounts that even an account admin cannot exceed, so it enforces org guardrails (no disabling logging, region limits) regardless of local IAM. IAM grants within that ceiling.
Why centralize logging in a separate account?
So a compromise of a workload account cannot delete or alter the audit trail. The logging account is tightly locked down, preserving evidence and integrity for investigation.
What the interviewer is listening for
- Account separation as blast-radius boundary
- SCP guardrails above IAM
- Centralized logging + SSO + landing zone + detection
What sinks the answer
- Only per-account IAM/MFA
- No notion of SCPs or account isolation
- Logging left in the workload account
If you genuinely do not know
Say this instead of freezing. Reasoning out loud from what you do know beats silence every single time, and a good interviewer is listening for exactly that.
“The unit of isolation is [the account, so separate teams/environments as blast-radius boundaries]. Add [Organizations SCP guardrails that IAM cannot override, deny disabling logging, restrict regions]. Centralize [CloudTrail/Config in a locked-down logging account] and use [SSO with short-lived roles]. Baseline every account via [a landing zone], protect [root with MFA], and detect with [GuardDuty/Security Hub/Config].”
Keep going with security
Foundation
Explain the shared responsibility model. Where does the cloud provider's job end and yours begin?
Foundation
What is the CIA triad, and why is it a useful way to think about security?
Foundation
What is the difference between authentication and authorization?
Junior
What is the difference between encryption at rest and in transit, and why do you need both?
Junior
How should an application running in the cloud get credentials to call other cloud services? Why avoid long-lived access keys?
Junior
What is the difference between symmetric and asymmetric encryption, and where is each used?
Knowing the answer is not the same as recalling it under pressure
Sign in to send the questions you fumble to spaced recall, so they come back right before you would forget them, and learn the concepts behind them with hands-on labs.
Start free