SAP-C02 Question 611
Select 2A company is setting up a multi-account strategy to manage its AWS environment for various business units. They want to enforce security baselines, manage policies centrally, and provide guardrails for accounts. Additionally, they require a solution to help automate account provisioning while ensuring compliance with organizational policies. Which combination of AWS tools should be used to achieve this?
- A
AWS Control Tower
- B
AWS Organizations
- C
AWS Config
- D
AWS CloudFormation
- E
Amazon CloudWatch
Show answer and explanation
Correct answers: A, B
Explanation
To meet the requirements of automating account provisioning, enforcing security baselines, and centralizing governance, AWS Control Tower and AWS Organizations are the correct tools. AWS Control Tower provides an easy way to set up and govern a secure multi-account AWS environment, while AWS Organizations allows centralized management of accounts and policies. Other services like AWS Config, AWS CloudFormation, and Amazon CloudWatch are valuable for specific use cases but are not designed for the stated requirements.
- A. Correct.
AWS Control Tower is designed to automate account provisioning, enforce guardrails, and ensure compliance in a multi-account environment, making it a key part of this solution.
- B. Correct.
AWS Organizations enables centralized management of policies, account structure, and service control policies (SCPs), making it essential for enforcing security baselines and governance across accounts.
- C. Incorrect.
While AWS Config is useful for tracking configuration changes and compliance, it is not responsible for account provisioning or centralized governance.
- D. Incorrect.
AWS CloudFormation is a powerful Infrastructure as Code (IaC) tool but is not used for account management, policy enforcement, or governance.
- E. Incorrect.
Amazon CloudWatch is a monitoring and observability service and does not address account provisioning or centralized governance needs.