DOP-C02 Question 113
Select 3Your organization has recently adopted a multi-account strategy to improve security and manage workloads more effectively. As the DevOps lead, you are tasked with designing the AWS account structure. Which of the following steps and best practices should you implement to ensure proper governance and scalability?
- A
Use AWS Organizations to create a centralized management structure and implement Service Control Policies (SCPs) to enforce restrictions.
- B
Create a single AWS account for all workloads to centralize billing and reduce complexity.
- C
Leverage AWS Control Tower to automate account creation and enforce organizational guardrails.
- D
Enable consolidated billing within AWS Organizations to centralize cost management across accounts.
- E
Create cross-account IAM users to manage permissions across multiple accounts directly.
Show answer and explanation
Correct answers: A, C, D
Explanation
A well-designed AWS account structure leverages AWS Organizations for centralized management and policy enforcement, AWS Control Tower for automated account creation and governance, and consolidated billing for cost management. These services align with AWS best practices for scalability, security, and governance in a multi-account environment. Avoid using a single account or cross-account IAM users, as these approaches do not adhere to AWS recommendations for security and scalability.
- A. Correct.
Correct: AWS Organizations provides a centralized way to manage multiple AWS accounts and enforce policies at scale using Service Control Policies (SCPs). This is a critical step in a multi-account strategy.
- B. Incorrect.
Incorrect: Using a single AWS account for all workloads is not a recommended best practice. It reduces the ability to isolate workloads, manage permissions effectively, and may lead to security risks.
- C. Correct.
Correct: AWS Control Tower simplifies the setup of a multi-account environment with automation and guardrails that align with AWS best practices.
- D. Correct.
Correct: Consolidated billing through AWS Organizations allows you to centralize cost management and benefit from volume discounts across accounts.
- E. Incorrect.
Incorrect: Cross-account IAM users are not a recommended approach for managing permissions in a multi-account structure. Instead, cross-account roles or AWS Organizations should be used for managing access.