SAP-C02 Question 97
Select 4A company is planning to design a multi-account AWS environment to manage its workloads across different teams. The company wants centralized billing, secure cross-account access, and minimal administrative overhead for managing permissions. Which combination of AWS services and features should they use to set up this environment?
- A
AWS Organizations with consolidated billing
- B
AWS Resource Access Manager (RAM) for sharing resources across accounts
- C
Cross-account IAM roles for secure access between accounts
- D
AWS Direct Connect for inter-account communication
- E
AWS Control Tower for automated account provisioning and governance
Show answer and explanation
Correct answers: A, B, C, E
Explanation
To design a scalable and secure multi-account AWS environment, AWS Organizations should be used for centralized billing and account management. For resource sharing, AWS Resource Access Manager (RAM) is essential, while cross-account IAM roles provide secure access between accounts. AWS Control Tower automates account provisioning and governance, ensuring policies and guardrails are enforced consistently. AWS Direct Connect is unrelated to managing multi-account environments and focuses on networking.
- A. Correct.
AWS Organizations with consolidated billing is ideal for managing multiple accounts under a single payment method, simplifying billing and cost tracking.
- B. Correct.
AWS Resource Access Manager (RAM) allows sharing of AWS resources securely across multiple accounts, which is essential in a multi-account environment.
- C. Correct.
Cross-account IAM roles enable secure and auditable access to resources in one account from another account, eliminating the need for hard-coded credentials.
- D. Incorrect.
AWS Direct Connect is a networking service used to establish dedicated connections between on-premises environments and AWS, but it is not relevant to managing a multi-account environment.
- E. Correct.
AWS Control Tower simplifies the creation and governance of multi-account environments, automating best practices and ensuring compliance with security policies.