DOP-C02 Question 106
Select 4Your organization is adopting a multi-account strategy on AWS and needs to automate the creation and onboarding of new accounts in a secure and compliant manner. The solution must ensure that all accounts are set up with baseline security controls (e.g., CloudTrail, AWS Config, Service Control Policies) and must scale across multiple Regions. Which combination of services and features should you use to achieve this?
- A
AWS Organizations with Service Control Policies (SCPs) for account governance
- B
AWS CloudFormation StackSets for deploying baseline configurations across accounts and Regions
- C
AWS Control Tower for automating account provisioning and applying guardrails
- D
Amazon Macie for managing account creation and compliance
- E
AWS Lambda for custom automation when specific onboarding actions are required
Show answer and explanation
Correct answers: A, B, C, E
Explanation
To automate multi-account creation, onboarding, and security in a multi-Region environment, AWS Organizations with SCPs, AWS CloudFormation StackSets, and AWS Control Tower are essential tools. AWS Organizations provides centralized governance, SCPs enforce security policies, and AWS Control Tower streamlines account provisioning and compliance guardrails. AWS Lambda complements these services by enabling custom automation workflows for specific onboarding tasks. Amazon Macie, while valuable for data security, is not applicable to account creation and onboarding.
- A. Correct.
AWS Organizations with SCPs is crucial for centralized governance and enforcing security policies across all accounts in a multi-account setup.
- B. Correct.
AWS CloudFormation StackSets allow you to automate and deploy baseline configurations (e.g., CloudTrail, AWS Config rules) across multiple accounts and Regions.
- C. Correct.
AWS Control Tower simplifies multi-account setup by automating account provisioning and applying security and compliance guardrails.
- D. Incorrect.
Amazon Macie is primarily used for data security and compliance focused on identifying sensitive data, but it is not relevant to automating account creation or onboarding.
- E. Correct.
AWS Lambda is often used for custom automation tasks, such as performing specific onboarding actions or integrating with other AWS services during account setup.