SAP-C02 Question 106
Select 3An enterprise wants to centrally manage multiple AWS accounts for billing, governance, and security purposes. They have decided to use AWS Organizations and AWS Control Tower. The company has the following requirements:
- Enforce mandatory security guardrails across all accounts.
- Provide a unified account provisioning process.
- Ensure that existing AWS accounts can be enrolled into the governance framework without manual configuration.
Which combination of actions should the Solutions Architect recommend?
- A
Enable AWS Control Tower in the management account to set up a landing zone and enforce guardrails.
- B
Use Service Control Policies (SCPs) in AWS Organizations to enforce guardrails across all accounts.
- C
Manually apply AWS Control Tower guardrails to existing accounts using AWS Config Rules.
- D
Enroll existing AWS accounts into AWS Control Tower using the Account Factory feature.
- E
Create a custom IAM role in each account to enforce compliance with AWS Control Tower guardrails.
Show answer and explanation
Correct answers: A, B, D
Explanation
To meet the requirements, AWS Control Tower should be enabled to create a landing zone, enforce guardrails, and provide a unified account provisioning process. Service Control Policies (SCPs) in AWS Organizations complement this by enforcing guardrails across accounts. To enroll existing accounts into AWS Control Tower, the Account Factory feature should be used, eliminating the need for manual guardrail configuration or custom IAM roles.
- A. Correct.
This is correct. AWS Control Tower sets up a landing zone and allows you to enforce guardrails. It helps manage governance at scale.
- B. Correct.
This is correct. SCPs in AWS Organizations are used to enforce permission boundaries and can complement AWS Control Tower’s guardrails.
- C. Incorrect.
This is incorrect. AWS Control Tower allows you to enroll existing accounts without needing manual configuration of guardrails using AWS Config Rules.
- D. Correct.
This is correct. The Account Factory feature in AWS Control Tower simplifies the process of enrolling existing accounts into the governance framework.
- E. Incorrect.
This is incorrect. AWS Control Tower automatically deploys the necessary roles and policies; creating custom IAM roles for guardrail compliance is unnecessary.