SAP-C02 Question 612
Select 2A global enterprise wants to enforce governance across multiple AWS accounts while ensuring that all accounts comply with company policies. They need a solution that provides a pre-configured environment with guardrails, automated account provisioning, and centralized logging for compliance auditing. Which combination of AWS services would you recommend to meet these requirements effectively?
- A
AWS Control Tower
- B
AWS Organizations
- C
AWS IAM Identity Center (formerly AWS Single Sign-On)
- D
AWS Config
- E
AWS Trusted Advisor
- F
AWS Service Catalog
Show answer and explanation
Correct answers: A, B
Explanation
The combination of AWS Control Tower and AWS Organizations is the most effective solution to enforce governance across multiple accounts. AWS Control Tower provides a pre-configured environment with guardrails and automated account provisioning, while AWS Organizations enables centralized governance through service control policies (SCPs) and multi-account management. Together, these services meet the requirements for compliance, centralized logging, and governance at scale.
- A. Correct.
AWS Control Tower provides a pre-configured multi-account environment with guardrails, automated account provisioning, and centralized logging, making it a key service for governance at scale.
- B. Correct.
AWS Organizations allows central governance and management of multiple AWS accounts, enabling the implementation of service control policies (SCPs) to enforce compliance across accounts.
- C. Incorrect.
While AWS IAM Identity Center helps with centralized user and access management, it does not provide automated account provisioning, guardrails, or a pre-configured environment for governance.
- D. Incorrect.
AWS Config helps track resource configuration and compliance, but it does not create or manage multi-account environments or enforce guardrails directly.
- E. Incorrect.
AWS Trusted Advisor provides recommendations to optimize costs, security, and performance, but it does not provide governance tools for multi-account environments or policy enforcement.
- F. Incorrect.
AWS Service Catalog helps manage approved resources for deployment but does not provide governance features such as account provisioning or guardrails.