SAP-C02 Question 5
Select 3An organization with multiple business units has adopted AWS Organizations to manage their cloud resources. They need to ensure that each business unit has strict control over its own AWS accounts while adhering to the organization's security and compliance requirements. Additionally, they want to centralize billing and enforce specific policies across all accounts. Which combination of approaches should they implement to meet these requirements?
- A
Use Service Control Policies (SCPs) to enforce security and compliance requirements across all accounts in the organization.
- B
Enable consolidated billing in AWS Organizations to centralize billing and manage costs across all accounts.
- C
Grant full administrative access to each business unit's AWS accounts without applying any restrictions to allow autonomy.
- D
Use Organizational Units (OUs) to group accounts by business units and apply SCPs at the OU level.
- E
Enable AWS Single Sign-On (AWS SSO) to manage user access centrally across all accounts in the organization.
Show answer and explanation
Correct answers: A, B, D
Explanation
To address the organization's requirements, a combination of Service Control Policies (SCPs) and Organizational Units (OUs) within AWS Organizations ensures that security and compliance policies are enforced at the appropriate level for each business unit. Enabling consolidated billing centralizes cost management across all accounts. Granting unrestricted administrative access contradicts governance requirements, and while AWS SSO is helpful for user access management, it does not directly address billing or policy enforcement.
- A. Correct.
Service Control Policies (SCPs) are a core feature of AWS Organizations and are used to enforce compliance and security requirements at the organizational, OU, or account level. This ensures that all accounts adhere to the organization's policies.
- B. Correct.
Consolidated billing is a feature of AWS Organizations that allows the organization to centralize billing across all accounts, providing a single billing entity and cost management benefits.
- C. Incorrect.
Granting full administrative access without restrictions contradicts the organization's need to enforce security and compliance requirements. This approach does not align with best practices for governance.
- D. Correct.
Using Organizational Units (OUs) to group accounts by business units allows the organization to apply SCPs at the OU level, ensuring that policies are enforced for specific groups of accounts while maintaining flexibility.
- E. Incorrect.
While AWS SSO can help manage user access centrally, it does not address the need for enforcing security and compliance policies or centralizing billing, which are the key requirements in this scenario.