DOP-C02 Question 104
Single answerYour organization is using AWS Organizations to manage a multi-account setup across multiple Regions. The organization requires that new AWS accounts be automatically provisioned with baseline security controls, including enabling AWS CloudTrail and AWS Config in all Regions. Additionally, all accounts must adhere to organizational compliance policies. Which approach would be the most appropriate to automate the creation and onboarding of new accounts while meeting these requirements?
- A
Use AWS Service Catalog to provision accounts with pre-configured security baselines and compliance settings.
- B
Use AWS Control Tower to create and manage accounts, and configure guardrails to enforce compliance policies.
- C
Manually create accounts in the AWS Management Console and then apply security baselines using AWS Config rules.
- D
Use a custom solution with AWS Lambda and AWS SDK to create accounts and apply security configurations.
Show answer and explanation
Correct answer: B
Explanation
AWS Control Tower is the best choice for automating the creation and onboarding of AWS accounts in a multi-account and multi-Region environment. It provides built-in capabilities for setting up security baselines, enabling AWS CloudTrail and AWS Config in all Regions, and enforcing compliance policies through guardrails. This simplifies management and reduces operational overhead compared to custom solutions or manual processes.
- A. Incorrect.
AWS Service Catalog is designed to manage approved resources like EC2 instances or S3 buckets, but it is not specialized for automating multi-account provisioning and compliance enforcement across Regions.
- B. Correct.
AWS Control Tower is specifically designed to automate the creation of AWS accounts, enforce governance using guardrails, and configure security baselines such as enabling AWS CloudTrail and AWS Config. It is the most suitable choice for this scenario.
- C. Incorrect.
Manually creating accounts and applying baselines is error-prone, not automated, and does not meet the requirements for scalability or compliance in a multi-account or multi-Region environment.
- D. Incorrect.
While a custom solution using Lambda and AWS SDK could achieve the goal, it requires extensive development effort and maintenance, and Control Tower offers a more streamlined and managed solution.