DOP-C02 Question 114
Select 3Your company is managing multiple AWS accounts for different teams, such as development, testing, and production. A recent security audit highlighted the need for better account management, centralized billing, and controlled access to shared services such as AWS Direct Connect. Which of the following steps should you take to implement a secure and scalable multi-account structure?
- A
Use AWS Organizations to manage accounts and enable consolidated billing.
- B
Set up AWS Service Catalog to enforce resource provisioning standards across multiple accounts.
- C
Implement a centralized shared services account for common services like AWS Direct Connect and Route 53.
- D
Use AWS Control Tower to automate the setup of a best-practice multi-account environment.
- E
Grant full administrator access to all users in each AWS account for easier management.
Show answer and explanation
Correct answers: A, C, D
Explanation
To implement a secure and scalable multi-account structure, AWS Organizations helps manage accounts and enables consolidated billing. A centralized shared services account ensures efficient management of shared resources, and AWS Control Tower automates the setup of a best-practice multi-account environment. These steps align with AWS-recommended practices for account structures and governance.
- A. Correct.
Using AWS Organizations allows you to group and manage multiple AWS accounts efficiently, and it provides consolidated billing to simplify financial management.
- B. Incorrect.
While AWS Service Catalog is useful for standardizing resource provisioning, it is not directly related to setting up a multi-account structure or centralized billing.
- C. Correct.
A centralized shared services account is a best practice for managing resources like AWS Direct Connect and Route 53 that are shared across multiple accounts.
- D. Correct.
AWS Control Tower simplifies the process of setting up and governing a secure, multi-account AWS environment based on AWS best practices.
- E. Incorrect.
Granting full administrator access to all users in each account violates the principle of least privilege and is a poor security practice.