SCS-C02 Question 463
Select 2Your organization has multiple AWS accounts managed under an AWS Organizations setup. You need a solution to centrally manage, deploy, and version Infrastructure as Code (IaC) templates to enforce security best practices across all accounts. Which AWS service combination should you use to achieve this in a secure and efficient manner?
- A
AWS CloudFormation StackSets
- B
AWS Systems Manager Parameter Store
- C
AWS Service Catalog
- D
AWS CodePipeline
- E
AWS Control Tower
- F
AWS Config
Show answer and explanation
Correct answers: A, C
Explanation
To centrally manage, deploy, and version Infrastructure as Code (IaC) templates across multiple AWS accounts, AWS CloudFormation StackSets and AWS Service Catalog work together to provide a robust solution. CloudFormation StackSets ensures consistent deployment of infrastructure, while Service Catalog enables centralized control and distribution of approved templates to enforce security and compliance policies.
- A. Correct.
AWS CloudFormation StackSets allows you to centrally manage and deploy CloudFormation templates across multiple AWS accounts and regions, enforcing consistent infrastructure provisioning.
- B. Incorrect.
AWS Systems Manager Parameter Store is used for securely storing configuration and secrets, but it is not designed for centralized management or deployment of AWS services.
- C. Correct.
AWS Service Catalog enables you to centrally manage and distribute approved infrastructure templates, ensuring security and compliance across accounts.
- D. Incorrect.
AWS CodePipeline is used for automating CI/CD pipelines but does not provide centralized management or enforcement of IaC templates across accounts.
- E. Incorrect.
AWS Control Tower is used for setting up and governing a secure multi-account AWS environment, but it does not manage IaC templates directly.
- F. Incorrect.
AWS Config is used for monitoring and assessing configuration compliance but does not handle template deployment or versioning.