SCS-C02 Question 67
Select 3A company requires strict resource isolation for multiple teams working on different projects within a single AWS account. Each team should have access only to its own resources, and there should be no possibility of accidental cross-team interference. Which of the following approaches will ensure proper resource isolation for the teams?
- A
Use AWS IAM policies to create fine-grained access controls and assign them to individual users.
- B
Organize resources into separate AWS Organizations accounts for each team.
- C
Use AWS Resource Access Manager (RAM) to share resources only with specific teams.
- D
Leverage AWS Control Tower to enforce account-level isolation between teams.
- E
Implement Resource Tags combined with IAM Condition keys to enforce team-based access control.
Show answer and explanation
Correct answers: B, D, E
Explanation
To ensure resource isolation in a single AWS account, you can use tagging combined with IAM Condition keys to enforce access control. Alternatively, for stronger isolation, you can use AWS Control Tower to create and manage separate AWS accounts. If using AWS Organizations, creating individual accounts for each team ensures the highest level of resource isolation, as resources in one account cannot interfere with those in another without explicit permissions. These approaches align with AWS’s best practices for resource isolation.
- A. Incorrect.
Using IAM policies alone does not ensure resource isolation, as IAM policies focus on granting or restricting permissions but don't inherently segregate resources.
- B. Correct.
Using separate AWS Organizations accounts is a strong mechanism for resource isolation because each account operates independently, and access between accounts is restricted unless explicitly allowed.
- C. Incorrect.
AWS Resource Access Manager (RAM) is used to share resources across accounts or within an organization. It doesn’t inherently isolate resources but rather facilitates sharing.
- D. Correct.
AWS Control Tower can enforce account-level isolation by creating and managing multiple AWS accounts under a single organization, which ensures strong separation of resources.
- E. Correct.
Combining resource tags with IAM Condition keys allows you to enforce access policies based on tags, enabling fine-grained, team-specific access control while maintaining resource isolation.