DOP-C02 Question 297
Single answerYour company has a multi-account setup in AWS and uses AWS Organizations to centrally manage all accounts. You are tasked with ensuring that certain security policies, such as requiring all EC2 instances to use encrypted EBS volumes, are consistently enforced across all member accounts. Which approach should you take to achieve this?
- A
Use AWS Config with an organization-wide rule to ensure EBS volumes are encrypted across all accounts.
- B
Manually create AWS Config rules in each individual account to verify EBS volume encryption.
- C
Use AWS Trusted Advisor to enforce encryption requirements across all accounts.
- D
Implement Service Control Policies (SCPs) in AWS Organizations to enforce EBS volume encryption.
Show answer and explanation
Correct answer: A
Explanation
To enforce consistent security policies such as EBS volume encryption across all accounts in an AWS Organization, AWS Config with organization-wide rules is the most effective and scalable solution. It allows you to centrally manage compliance checks and ensures that all member accounts adhere to the required security standards. SCPs are useful for restricting actions but cannot enforce specific resource configurations. Trusted Advisor only provides recommendations and does not enforce policies, while manually creating Config rules in each account is inefficient and prone to errors.
- A. Correct.
This is the correct approach. AWS Config allows you to create organization-wide rules, which can evaluate compliance for resources across all accounts in your AWS Organization. This ensures that EBS volume encryption is consistently enforced.
- B. Incorrect.
This approach is not scalable or efficient, as it requires creating and managing Config rules in each individual account. It also does not leverage the benefits of AWS Organizations for centralized management.
- C. Incorrect.
AWS Trusted Advisor provides security and optimization recommendations, but it does not enforce compliance with specific policies like EBS volume encryption.
- D. Incorrect.
Service Control Policies (SCPs) in AWS Organizations are used to define permissions and restrict certain actions but cannot enforce resource-specific configurations such as EBS volume encryption.