SCS-C02 Question 427
Single answerYour organization has adopted a multi-account strategy using AWS Organizations. The security team wants to enforce specific security measures across all accounts, such as ensuring CloudTrail is enabled and logging to a central S3 bucket. What is the best way to implement and maintain this requirement across all accounts in the organization?
- A
Manually enable CloudTrail in each account and configure it to log to the central S3 bucket.
- B
Use Service Control Policies (SCPs) in AWS Organizations to enforce CloudTrail logging across all accounts.
- C
Set up an AWS Config aggregator in a central account to monitor CloudTrail status across all accounts.
- D
Use AWS Control Tower to set up governance guardrails and enable CloudTrail logging during account provisioning.
Show answer and explanation
Correct answer: D
Explanation
AWS Control Tower provides a scalable and automated solution for managing multi-account environments. It simplifies governance by setting up guardrails, such as enabling CloudTrail and centralizing logs, ensuring compliance across all accounts in the organization. This approach minimizes manual efforts and reduces the risk of misconfiguration, making it the best choice for enforcing security measures in a multi-account strategy.
- A. Incorrect.
Manually enabling CloudTrail in each account is not scalable and is prone to human error. It is not the recommended approach for enforcing organization-wide compliance.
- B. Incorrect.
Service Control Policies (SCPs) are used to restrict access or define permissions at the account level, but they cannot enforce service-specific configurations like enabling CloudTrail or specifying logging destinations.
- C. Incorrect.
While AWS Config can help monitor and report CloudTrail status, it does not automatically enforce the configuration across accounts. It is more suited for auditing and compliance checks.
- D. Correct.
AWS Control Tower is designed to implement a multi-account governance strategy. It supports setting up guardrails that ensure compliance for services like CloudTrail and can automate the configuration of logging to a central S3 bucket during account creation.