SAP-C02 Question 99
Select 4Your organization is planning to implement a multi-account AWS environment to improve security, cost management, and governance. The organization needs a design that ensures centralized management of policies, consolidated billing, and the ability to isolate workloads by environment (e.g., development, testing, production). Which combination of approaches should you recommend?
- A
Use AWS Organizations to create a multi-account structure and apply Service Control Policies (SCPs) for governance.
- B
Use a single AWS account with multiple IAM roles to isolate workloads for development, testing, and production environments.
- C
Enable consolidated billing in AWS Organizations to centralize payment management across accounts.
- D
Leverage AWS Control Tower to automate account provisioning and standardize governance across the multi-account environment.
- E
Use Resource Access Manager (RAM) to share resources securely between accounts where needed.
Show answer and explanation
Correct answers: A, C, D, E
Explanation
A well-designed multi-account AWS environment should use AWS Organizations to manage accounts, apply governance using SCPs, and enable consolidated billing for cost efficiency. AWS Control Tower simplifies the setup and governance of such environments. Additionally, AWS Resource Access Manager (RAM) facilitates secure resource sharing, which is crucial to avoid resource duplication across accounts. Using a single account with IAM roles for workload separation does not provide the same level of security, isolation, or scalability as a multi-account strategy.
- A. Correct.
Correct: AWS Organizations is the recommended service for setting up and managing a multi-account structure. Service Control Policies (SCPs) allow centralized governance across accounts.
- B. Incorrect.
Incorrect: While IAM roles can be used for access management, isolating workloads for development, testing, and production in a single account does not align with best practices for a secure, multi-account strategy.
- C. Correct.
Correct: Consolidated billing in AWS Organizations simplifies cost management by aggregating all account bills into a single payment, which is a key benefit of the multi-account structure.
- D. Correct.
Correct: AWS Control Tower provides a prescriptive and automated way to set up and manage a secure, multi-account AWS environment following best practices.
- E. Correct.
Correct: AWS Resource Access Manager (RAM) enables secure sharing of resources (e.g., VPCs) between accounts, which is essential in a multi-account setup to avoid unnecessary duplication.