SCS-C02 Question 419
Select 3Your organization is undergoing rapid growth, and the security team has been tasked with centrally managing multiple AWS accounts to ensure consistent security policies, access control, and billing management. Which combination of AWS services and features should you use to implement this strategy effectively?
- A
AWS Organizations with Service Control Policies (SCPs)
- B
AWS Config to enforce account-level compliance rules
- C
AWS Control Tower for automated account provisioning and governance
- D
Amazon CloudWatch to monitor and centrally manage account usage
- E
AWS CloudFormation StackSets for deploying resources across accounts
Show answer and explanation
Correct answers: A, C, E
Explanation
To centrally deploy and manage AWS accounts, you need a combination of services that ensure governance, automation, and resource consistency. AWS Organizations and SCPs provide central management and policy enforcement, AWS Control Tower automates account provisioning and governance with guardrails, and AWS CloudFormation StackSets ensures consistent deployment of resources across accounts. These services together form a robust strategy for centralized account management.
- A. Correct.
AWS Organizations with Service Control Policies (SCPs) is essential for centrally managing multiple accounts, enabling the organization to apply governance and access controls across all accounts in a structure.
- B. Incorrect.
AWS Config is useful for compliance monitoring at the account level, but it does not provide centralized account management or automated account provisioning.
- C. Correct.
AWS Control Tower provides a comprehensive solution for setting up and governing a secure multi-account environment, including automated provisioning and guardrails.
- D. Incorrect.
Amazon CloudWatch is primarily a monitoring tool and does not directly assist in centralized account management or governance.
- E. Correct.
AWS CloudFormation StackSets enable you to deploy AWS resources consistently across multiple accounts and regions, which is critical for managing resources in a multi-account strategy.