DOP-C02 Question 115
Select 3Your organization has recently adopted AWS Organizations to manage multiple AWS accounts. The goal is to improve security, cost management, and operational efficiency. Which of the following are best practices for managing accounts under AWS Organizations?
- A
Enable AWS Control Tower to automate the setup of a multi-account environment and enforce guardrails.
- B
Grant all accounts full administrator access to ensure teams can operate independently.
- C
Use Service Control Policies (SCPs) to restrict actions that should not be allowed across accounts.
- D
Consolidate billing by enabling the AWS Billing and Cost Management service and setting up a payer account.
- E
Manually maintain IAM roles in each account to handle cross-account access.
Show answer and explanation
Correct answers: A, C, D
Explanation
Managing multiple accounts under AWS Organizations requires adopting best practices to achieve security, operational efficiency, and effective cost management. AWS Control Tower simplifies account setup and compliance, Service Control Policies (SCPs) enforce security boundaries, and consolidated billing streamlines financial management. Avoid granting overly broad permissions or relying on manual processes for cross-account access.
- A. Correct.
Enabling AWS Control Tower is a recommended best practice as it helps automate the setup of a secure multi-account environment, provides guardrails, and ensures compliance.
- B. Incorrect.
Granting all accounts full administrator access is not a best practice as it creates significant security risks by unnecessarily broadening permissions.
- C. Correct.
Using Service Control Policies (SCPs) is a critical best practice for restricting actions that should not be allowed across accounts, enhancing security and compliance.
- D. Correct.
Consolidating billing by enabling AWS Billing and Cost Management and setting up a payer account is a best practice for simplifying cost management and reducing administrative overhead.
- E. Incorrect.
Manually maintaining IAM roles in each account is not a best practice as it is prone to errors and inefficiencies; instead, automated solutions like AWS IAM Identity Center (SSO) should be used for central access management.