SCS-C02 Question 450
Single answerYou are a Security Engineer at a company that uses AWS Organizations to manage multiple accounts. The company requires all member accounts to have specific security policies in place, such as blocking public S3 buckets and enforcing encryption on EBS volumes. Which approach ensures these security policies are applied across all member accounts, including any new accounts created in the future?
- A
Enable AWS Config in each member account and configure rules for S3 bucket permissions and EBS encryption.
- B
Create Service Control Policies (SCPs) in the management account to enforce the security requirements at the organizational level.
- C
Use AWS CloudFormation StackSets to deploy security configurations to all member accounts.
- D
Manually apply the security configurations in each member account and repeat the process for new accounts.
Show answer and explanation
Correct answer: B
Explanation
Service Control Policies (SCPs) are the most efficient and scalable way to enforce security controls across all member accounts in an AWS Organization. By applying SCPs at the organizational unit or root level, you ensure that all member accounts, including newly created ones, comply with the defined security requirements. Other approaches like AWS Config or manual configurations require significant effort and do not provide centralized enforcement.
- A. Incorrect.
While AWS Config can monitor and enforce compliance with rules within a single account, it does not provide centralized enforcement across all member accounts. This approach would require manual setup in each account, which is not scalable.
- B. Correct.
Service Control Policies (SCPs) in AWS Organizations allow you to define and enforce security policies at the organizational level. SCPs apply to all member accounts, including newly created ones, ensuring compliance with corporate security requirements.
- C. Incorrect.
AWS CloudFormation StackSets can deploy configurations across multiple accounts, but it does not enforce policies at the organizational level. Additionally, this approach would require re-deployment for new accounts, making it less efficient for ongoing compliance.
- D. Incorrect.
Manually applying configurations in each account is error-prone and not scalable, especially for large organizations or when new accounts are frequently created.