ANS-C01 Question 311
Single answerYou are managing a multi-account AWS environment using AWS Organizations. Your organization requires a consistent network setup across all new AWS accounts, including VPCs, subnets, route tables, and NAT Gateways. How can you automate this process to ensure compliance and consistency when provisioning new accounts?
- A
Use AWS Control Tower to automate account creation and configure network infrastructure by leveraging AWS CloudFormation templates.
- B
Manually create the required network infrastructure in each account and document the configuration for future reference.
- C
Use AWS Systems Manager Automation to execute scripts that configure the network infrastructure across all accounts.
- D
Leverage AWS Service Catalog to create pre-approved network environment templates and enforce their usage during account provisioning.
Show answer and explanation
Correct answer: A
Explanation
AWS Control Tower is the most suitable solution for this scenario as it automates the provisioning of new accounts and ensures compliance through pre-defined templates and governance policies. It simplifies the management of multi-account environments by integrating with AWS Organizations and leveraging CloudFormation for consistent network infrastructure setups.
- A. Correct.
Correct. AWS Control Tower provides a managed service for setting up and governing multi-account AWS environments. It supports automation of account creation and network infrastructure setup by using Landing Zones, which can include AWS CloudFormation templates for consistent VPC and networking configurations.
- B. Incorrect.
Incorrect. Manually creating and documenting configurations is error-prone, time-consuming, and does not scale well for a multi-account environment. It also fails to meet the requirement of automation.
- C. Incorrect.
Incorrect. AWS Systems Manager Automation is a powerful tool for executing operational tasks, but it is not ideal for provisioning new accounts and their associated network infrastructure in a multi-account setup.
- D. Incorrect.
Incorrect. AWS Service Catalog allows for the deployment of pre-approved resources but does not handle the automation of account creation and governance like AWS Control Tower does.