SAP-C02 Question 608
Select 2An organization is using AWS Organizations to manage multiple accounts and wants to enforce consistent governance and security policies across all their accounts. They also want to provide a fully automated, best-practices setup for new accounts while maintaining centralized logging. Which combination of AWS services should the organization use to achieve this goal?
- A
AWS Control Tower
- B
AWS Service Catalog
- C
AWS CloudFormation StackSets
- D
AWS Organizations
- E
AWS Config
Show answer and explanation
Correct answers: A, D
Explanation
To enforce governance and security policies across all accounts and provide an automated setup for new accounts, AWS Control Tower and AWS Organizations are the best combination. AWS Control Tower automates the setup of a multi-account environment using best practices and integrates with AWS Organizations to apply governance controls such as Service Control Policies (SCPs). Together, these services ensure centralized management, security, and compliance for the organization.
- A. Correct.
AWS Control Tower provides a fully automated and best-practices setup for new accounts, including centralized logging and governance controls, making it the primary service for this scenario.
- B. Incorrect.
AWS Service Catalog is used for creating and managing approved AWS resources and services, but it is not designed for enforcing governance across multiple accounts.
- C. Incorrect.
AWS CloudFormation StackSets can deploy resources across multiple accounts, but it is not a governance tool for enforcing policies or managing account creation.
- D. Correct.
AWS Organizations is a key service for managing multiple AWS accounts under a single management structure, enabling centralized control and enforcement of Service Control Policies (SCPs).
- E. Incorrect.
AWS Config provides resource compliance and monitoring capabilities but does not manage account creation or enforce governance policies across multiple accounts.