SCS-C02 Question 418
Select 3Your organization is rapidly expanding and plans to onboard multiple AWS accounts for different business units to ensure resource isolation and billing transparency. As the security lead, you are tasked with designing a strategy to centrally deploy and manage these AWS accounts while maintaining governance, enforcing security policies, and ensuring compliance. Which combination of actions should you take to achieve this?
- A
Use AWS Organizations to centrally manage accounts and establish a multi-account structure.
- B
Enable AWS Control Tower to automate governance and account provisioning.
- C
Manually create each AWS account and independently apply security policies.
- D
Use Service Control Policies (SCPs) within AWS Organizations to enforce compliance across accounts.
- E
Enable cross-account access by sharing IAM roles between all accounts for centralized management.
Show answer and explanation
Correct answers: A, B, D
Explanation
To centrally deploy and manage multiple AWS accounts while maintaining governance and security, you should leverage AWS Organizations for account management, AWS Control Tower for automated provisioning and governance, and Service Control Policies (SCPs) for enforcing compliance across accounts. These services are designed to handle multi-account structures effectively, ensuring scalability, security, and compliance. Manually managing accounts or relying solely on IAM roles does not provide the required level of governance and automation.
- A. Correct.
Correct. AWS Organizations is the primary service for centrally managing and structuring accounts, enabling a unified governance strategy.
- B. Correct.
Correct. AWS Control Tower simplifies multi-account governance by providing automated account provisioning and guardrails for security and compliance.
- C. Incorrect.
Incorrect. Manually creating accounts and managing them separately is inefficient and prone to errors, especially at scale. Centralized management is critical for governance.
- D. Correct.
Correct. Service Control Policies (SCPs) within AWS Organizations allow you to enforce permissions and compliance across all member accounts in the organization.
- E. Incorrect.
Incorrect. While IAM roles can provide cross-account access, relying solely on IAM roles for centralized management does not ensure governance, compliance, or automation.