DOP-C02 Question 112
Select 3Your organization is planning to use AWS Organizations to manage multiple AWS accounts. The security team has outlined the following requirements: 1) Centralized management of Service Control Policies (SCPs) to enforce access controls. 2) Separation of billing and budgets for different departments. 3) Ability to share resources such as Amazon RDS snapshots and Amazon S3 buckets between accounts. Which combination of strategies and services would best meet these requirements?
- A
Use AWS Organizations to centrally manage SCPs and set up an organizational structure with Organizational Units (OUs) for departments.
- B
Enable consolidated billing in AWS Organizations and use AWS Budgets to track spending for each account.
- C
Enable AWS Resource Access Manager (RAM) to share resources like Amazon RDS snapshots and Amazon S3 buckets across accounts.
- D
Use AWS Control Tower to manage resource sharing and billing for all accounts.
- E
Set up separate standalone AWS accounts for each department and manually track billing and budgets.
Show answer and explanation
Correct answers: A, B, C
Explanation
To meet the given requirements, AWS Organizations is the best choice for centralized management of SCPs and consolidated billing. AWS Budgets can help monitor spending, while AWS Resource Access Manager (RAM) facilitates resource sharing between accounts. AWS Control Tower is useful for account setup and governance but does not directly address the requirements for billing or resource sharing. Using standalone accounts would increase complexity and fail to leverage AWS's centralized management capabilities.
- A. Correct.
Correct. AWS Organizations allows centralized management of Service Control Policies (SCPs) and facilitates creating Organizational Units (OUs) to logically group and manage accounts.
- B. Correct.
Correct. Consolidated billing in AWS Organizations provides a single payment method for all accounts, and AWS Budgets can be used to monitor and control spending.
- C. Correct.
Correct. AWS Resource Access Manager (RAM) is specifically designed to share resources like Amazon RDS snapshots and Amazon S3 buckets between accounts.
- D. Incorrect.
Incorrect. AWS Control Tower is primarily used to set up and govern a multi-account environment, but it does not manage resource sharing or billing directly.
- E. Incorrect.
Incorrect. Setting up standalone AWS accounts contradicts the requirement for centralized management and would require additional manual effort to track billing and budgets.