SAP-C02 Question 609
Select 2A large organization with multiple AWS accounts wants to ensure consistent governance and compliance across all accounts while allowing individual teams to manage their resources independently. They also need to enforce mandatory security guardrails such as restricting public S3 buckets and ensuring that all resources are tagged according to organizational standards. Which combination of AWS services would best meet these requirements?
- A
AWS Control Tower and AWS Organizations
- B
AWS Config and AWS Systems Manager
- C
AWS Control Tower and Service Control Policies (SCPs)
- D
AWS Organizations and AWS CloudFormation StackSets
- E
AWS Identity and Access Management (IAM) and AWS Trusted Advisor
Show answer and explanation
Correct answers: A, C
Explanation
AWS Control Tower is designed to manage multi-account environments by integrating with AWS Organizations and enabling governance with pre-configured guardrails. Service Control Policies (SCPs) provided by AWS Organizations allow enforcement of organizational rules, such as restricting public S3 buckets or ensuring proper tagging. This combination meets the organization's needs for consistent compliance while allowing teams to manage their resources independently.
- A. Correct.
Correct: AWS Control Tower and AWS Organizations together provide a comprehensive solution for account governance, enabling the setup of a multi-account environment with pre-configured guardrails and policies.
- B. Incorrect.
Incorrect: While AWS Config and AWS Systems Manager are useful for resource compliance and operational management, they do not provide centralized account governance or enforce guardrails across multiple accounts.
- C. Correct.
Correct: AWS Control Tower uses Service Control Policies (SCPs) from AWS Organizations to enforce mandatory guardrails and restrict specific actions across accounts, meeting the organization's requirements.
- D. Incorrect.
Incorrect: AWS Organizations and AWS CloudFormation StackSets are useful for managing resources across accounts, but they do not provide the level of governance and pre-configured guardrails that AWS Control Tower offers.
- E. Incorrect.
Incorrect: IAM and AWS Trusted Advisor are helpful for access control and best practice recommendations, but they do not address multi-account governance or enforcement of organizational guardrails.