SAP-C02 Question 98
Select 3Your organization has multiple teams that require isolated AWS accounts for their projects. The security team requires centralized logging for all accounts, the finance team needs consolidated billing, and the operations team requires a way to enforce security policies across accounts. How should you design the multi-account environment to meet these requirements?
- A
Use AWS Organizations to manage accounts and enable consolidated billing.
- B
Set up an S3 bucket in a dedicated logging account and configure AWS CloudTrail to send logs from all accounts to the bucket.
- C
Implement AWS Control Tower to establish guardrails and enforce security policies across accounts.
- D
Use individual standalone AWS accounts for each team, with no centralized management, to ensure maximum isolation.
- E
Enable Amazon Macie in each account to monitor sensitive data and provide centralized logging capabilities.
Show answer and explanation
Correct answers: A, B, C
Explanation
The correct approach involves using AWS Organizations for account management and billing consolidation, configuring centralized logging in a dedicated logging account, and establishing security policies with AWS Control Tower. These services together address the needs of the security, finance, and operations teams while following best practices for multi-account AWS environments.
- A. Correct.
Correct: AWS Organizations provides a centralized way to manage multiple AWS accounts and enables consolidated billing, making it an essential part of a multi-account strategy.
- B. Correct.
Correct: Using a dedicated logging account with an S3 bucket for AWS CloudTrail logs ensures centralized logging, which is a key requirement for the security team.
- C. Correct.
Correct: AWS Control Tower provides a way to set up multi-account environments with guardrails to enforce security and compliance policies, addressing the operations team's needs.
- D. Incorrect.
Incorrect: Using standalone accounts without centralized management does not meet the requirements for centralized logging, billing, or security policy enforcement.
- E. Incorrect.
Incorrect: While Amazon Macie is useful for monitoring sensitive data, it does not provide centralized logging capabilities or meet the requirements for consolidated billing or security policy enforcement.