SCS-C02 Question 417
Select 3Your organization is rapidly expanding its cloud infrastructure and frequently creating new AWS accounts for different teams and projects. To ensure consistent security, compliance, and cost management across all accounts, you are tasked with implementing a centralized account management strategy. Which combination of services and features would best meet this requirement?
- A
AWS Organizations with Service Control Policies (SCPs)
- B
AWS Config with centralized aggregator in a management account
- C
AWS Control Tower for account provisioning and governance
- D
Amazon S3 for storing account audit logs from all accounts
- E
AWS IAM for managing cross-account access
Show answer and explanation
Correct answers: A, B, C
Explanation
To centrally deploy and manage AWS accounts, you need services that focus on organizational governance, compliance monitoring, and streamlined account provisioning. AWS Organizations with SCPs ensures centralized permission management, AWS Config monitors compliance across accounts, and AWS Control Tower simplifies account provisioning and enforces guardrails. While Amazon S3 and AWS IAM are useful for other security tasks, they don't fulfill the requirements for centralized account management.
- A. Correct.
AWS Organizations with Service Control Policies (SCPs) is correct because it allows you to centrally manage permissions and apply guardrails across all AWS accounts in your organization.
- B. Correct.
AWS Config with a centralized aggregator is correct because it provides a way to monitor compliance and configuration drift across multiple accounts from a single management account.
- C. Correct.
AWS Control Tower is correct because it simplifies the process of creating and managing new AWS accounts while ensuring they adhere to company policies and governance frameworks.
- D. Incorrect.
Amazon S3 is incorrect because, while it can store audit logs, it does not provide centralized deployment or management capabilities for AWS accounts.
- E. Incorrect.
AWS IAM is incorrect because it is primarily used for managing permissions within an account and does not provide centralized account deployment or governance capabilities.