SCS-C02 Question 415
Select 3An organization is using AWS Organizations to manage multiple AWS accounts. The security team wants to enforce specific security controls, such as requiring all accounts to enable AWS CloudTrail and restricting the use of certain AWS Regions. Which combination of actions should the team take to achieve this?
- A
Use Service Control Policies (SCPs) to restrict access to specific AWS Regions.
- B
Enable AWS Config in all accounts to monitor compliance with CloudTrail requirements.
- C
Use IAM policies in each account to restrict access to specific AWS Regions.
- D
Enable CloudTrail in the management account and share the logs with all member accounts.
- E
Create an AWS Config rule to ensure CloudTrail is enabled in all accounts.
Show answer and explanation
Correct answers: A, B, E
Explanation
To enforce security controls across multiple AWS accounts managed by AWS Organizations, Service Control Policies (SCPs) must be used for organization-wide restrictions (e.g., limiting access to specific AWS Regions). AWS Config and Config rules ensure compliance with security requirements such as CloudTrail activation. IAM policies and enabling CloudTrail only in the management account are insufficient for implementing consistent governance across all accounts.
- A. Correct.
Service Control Policies (SCPs) are applied at the organizational level to enforce restrictions, such as limiting access to certain AWS Regions, ensuring consistency across all accounts.
- B. Correct.
AWS Config can monitor compliance with security controls, such as verifying that CloudTrail is enabled in all accounts, and is useful for governance and auditing purposes.
- C. Incorrect.
IAM policies are applied at the individual account level. While they can restrict access, they cannot enforce organization-wide restrictions, making them unsuitable for this use case.
- D. Incorrect.
Enabling CloudTrail in the management account only covers that account. CloudTrail must be enabled in each account to ensure compliance, and sharing logs is not a governance requirement.
- E. Correct.
AWS Config rules can automatically check and enforce compliance with security best practices, such as verifying that AWS CloudTrail is enabled in all accounts.