SAP-C02 Question 448
Select 4A company is designing a multi-account AWS environment using AWS Organizations. The organization requires centralized management of policies, consolidated billing, and enforcement of security controls across all member accounts. The company also wants to ensure that specific services such as AWS CloudTrail and AWS Config are enabled in all accounts for compliance purposes. Which combination of steps will achieve these requirements?
- A
Enable AWS Control Tower on the management account to automate the setup of the multi-account environment and implement guardrails.
- B
Use AWS Service Control Policies (SCPs) to enforce security-related policies across all member accounts.
- C
Manually enable AWS CloudTrail and AWS Config individually in each member account.
- D
Use AWS Config Aggregators to consolidate configuration and compliance data across all accounts.
- E
Set up AWS CloudFormation StackSets to automate the deployment of required service configurations across all accounts.
Show answer and explanation
Correct answers: A, B, D, E
Explanation
To meet the requirements of centralized management, consolidated billing, and security enforcement, AWS Control Tower is an ideal solution for setting up the multi-account environment. SCPs enforce security policies across all accounts, while AWS Config Aggregators ensure compliance data is centralized. AWS CloudFormation StackSets automate the deployment of configurations like enabling AWS CloudTrail and AWS Config in all accounts. Manually enabling these services is not efficient or scalable for a large organization.
- A. Correct.
Enabling AWS Control Tower streamlines the setup of a multi-account AWS environment and automates the enforcement of guardrails, which aligns with the organization's requirements for centralized management and security.
- B. Correct.
Service Control Policies (SCPs) are used to enforce security controls and restrict certain actions across all member accounts within an AWS Organization, making them essential for the company's needs.
- C. Incorrect.
While manually enabling AWS CloudTrail and AWS Config is possible, it is not scalable or efficient, especially in a large organization with many accounts.
- D. Correct.
AWS Config Aggregators consolidate configuration and compliance data across multiple accounts and regions, making it easier to manage compliance at the organizational level.
- E. Correct.
AWS CloudFormation StackSets enable automated and consistent deployment of resources and configurations across all accounts, reducing manual effort and ensuring uniformity.