SAP-C02 Question 107
Single answerAn organization is using AWS Organizations to manage multiple AWS accounts. The management team wants to implement governance, security, and compliance controls across all accounts, while also enabling the rapid setup of new accounts with pre-configured security baselines. Additionally, they want to allow specific teams to customize their accounts within defined guardrails. Which solution should you recommend?
- A
Use AWS Organizations to create Service Control Policies (SCPs) and manually configure each account with the required security baselines.
- B
Use AWS Control Tower to set up a landing zone, deploy guardrails, and automate governance and account configuration.
- C
Use AWS Config to enforce compliance rules across all accounts and allow teams to customize their configurations individually.
- D
Use AWS Systems Manager to distribute security baselines to all accounts and rely on IAM policies for governance.
Show answer and explanation
Correct answer: B
Explanation
AWS Control Tower is purpose-built for managing multi-account environments in AWS. It leverages AWS Organizations to establish a landing zone, enforces governance through guardrails, and automates account setup with security baselines. This makes it the most suitable solution for the scenario described, as it addresses the requirements of governance, compliance, and rapid account configuration.
- A. Incorrect.
While SCPs in AWS Organizations can restrict permissions, they do not assist in automating account setup or configuring baselines. This option requires significant manual effort and lacks the automation capabilities needed for rapid setup.
- B. Correct.
AWS Control Tower is designed for this use case. It provides a landing zone, enables governance through guardrails, and automates the setup of new accounts with pre-configured baselines. It also integrates with AWS Organizations.
- C. Incorrect.
While AWS Config can enforce compliance rules, it does not provide the ability to set up accounts rapidly or deploy predefined security baselines. It is more suited for monitoring and compliance than for account creation and governance.
- D. Incorrect.
AWS Systems Manager can distribute configurations, but it is not built for governance or account setup at scale. IAM policies alone are insufficient for the comprehensive governance and compliance needed in this scenario.