DOP-C02 Question 107
Select 2Your organization uses AWS Organizations to manage a multi-account setup spanning multiple AWS Regions. You have been tasked with automating the creation and onboarding of new AWS accounts while ensuring that they are secured with baseline guardrails. Additionally, security and compliance teams require that every new account automatically includes CloudTrail logging enabled across all Regions. Which combination of actions will meet these requirements?
- A
Use AWS Control Tower to automate account creation, enforce guardrails, and enable CloudTrail logging in all Regions.
- B
Write a custom AWS Lambda function to call the CreateAccount API of AWS Organizations and configure CloudTrail logging across all Regions.
- C
Leverage AWS Service Catalog to define account creation templates with pre-configured CloudTrail logging and guardrails.
- D
Enable AWS Config in every new account to manage compliance and ensure CloudTrail is configured correctly in all Regions.
- E
Use AWS Organizations Service Control Policies (SCPs) to enforce the use of CloudTrail logging in all accounts.
Show answer and explanation
Correct answers: A, E
Explanation
The combination of AWS Control Tower and Service Control Policies (SCPs) is the most effective solution for automating account creation, onboarding, and ensuring security guardrails in a multi-account AWS environment. AWS Control Tower simplifies multi-account setup while providing baseline security controls like enabling CloudTrail logging. SCPs can further enforce compliance by restricting actions and ensuring CloudTrail remains enabled across all accounts. Other options, such as a custom Lambda function or AWS Config, either require significant custom development or do not fully address the requirements.
- A. Correct.
This is a correct option. AWS Control Tower provides a fully managed solution for automating account creation, enforcing guardrails, and enabling CloudTrail logging across all Regions.
- B. Incorrect.
This is not the best option because while a custom Lambda function could be used for account creation, it would require significant custom development and wouldn’t automatically enforce guardrails as AWS Control Tower does.
- C. Incorrect.
This is not correct because AWS Service Catalog is primarily used for provisioning compliant infrastructure templates, not for automating account creation or enabling guardrails at the organizational level.
- D. Incorrect.
This is not correct because AWS Config helps manage compliance but does not automate the account creation process or enable CloudTrail logging across all Regions.
- E. Correct.
This is a correct option. Service Control Policies (SCPs) in AWS Organizations can enforce security requirements such as mandating the use of CloudTrail in all accounts.