SAP-C02 Question 610
Single answerAn enterprise organization wants to establish a multi-account AWS environment to isolate workloads by teams and ensure compliance with governance policies. They require centralized management of accounts, automated account provisioning, and the ability to enforce guardrails to meet security and compliance requirements. Which solution best meets their needs?
- A
Use AWS Organizations combined with AWS Service Catalog to manage accounts and enforce governance.
- B
Implement AWS Control Tower to set up the multi-account environment, automate account provisioning, and enforce governance guardrails.
- C
Manually create AWS accounts and use AWS Config to enforce compliance across accounts.
- D
Use AWS CloudFormation StackSets to deploy compliance templates across accounts and manually manage the account lifecycle.
Show answer and explanation
Correct answer: B
Explanation
AWS Control Tower is the ideal solution for organizations looking to establish a multi-account environment with centralized management, automated account provisioning, and governance guardrails. It leverages AWS Organizations for account management and integrates with other AWS services to enforce security and compliance policies across the environment, addressing all the specified requirements in the scenario.
- A. Incorrect.
While AWS Organizations and AWS Service Catalog can be used for some aspects of account and resource management, they do not natively provide end-to-end automation for account provisioning and governance guardrails like AWS Control Tower does.
- B. Correct.
AWS Control Tower is specifically designed for setting up and governing multi-account environments. It provides automated account provisioning, governance guardrails, and integration with AWS Organizations, making it the best fit for this scenario.
- C. Incorrect.
Manually creating accounts and using AWS Config for compliance requires significant manual effort and does not provide the centralized governance and automation needed in this scenario.
- D. Incorrect.
AWS CloudFormation StackSets can help with compliance by deploying configurations across accounts, but it does not provide automated account provisioning or governance guardrails, which are key requirements in this case.