SCS-C02 Question 413
Single answerAn organization wants to ensure compliance with security policies and regulatory standards across all AWS accounts in their multi-account setup. They need a solution that allows them to centrally manage security baselines, detect deviations, and enforce mandatory controls, such as blocking public S3 bucket access. Which AWS service or feature should they use to achieve this?
- A
AWS Security Hub
- B
AWS Control Tower
- C
AWS Config with Config Rules
- D
AWS Organizations Service Control Policies (SCPs)
Show answer and explanation
Correct answer: D
Explanation
AWS Organizations Service Control Policies (SCPs) are the most appropriate solution in this scenario because they allow you to enforce security controls centrally across all AWS accounts in an organization. SCPs can restrict or deny specific actions, such as blocking public S3 bucket access, ensuring that security baselines and regulatory standards are adhered to across the multi-account setup. Other options like AWS Security Hub or Config Rules are useful for monitoring compliance but do not enforce mandatory restrictions.
- A. Incorrect.
While AWS Security Hub provides a way to monitor compliance and security findings across accounts, it does not enforce mandatory controls or manage security baselines directly.
- B. Incorrect.
AWS Control Tower helps set up and govern a multi-account environment, but it is not specifically designed to enforce ongoing security baselines or block specific actions like public S3 bucket access.
- C. Incorrect.
AWS Config with Config Rules allows you to monitor and evaluate the compliance of specific resources, but it does not enforce mandatory controls across accounts.
- D. Correct.
AWS Organizations Service Control Policies (SCPs) enable you to enforce security controls across multiple accounts by restricting actions, such as blocking public S3 bucket access, at an account or organizational unit level.