SOA-C02 Question 193
Single answerYour organization has multiple AWS accounts for different teams (e.g., development, QA, and production). You need to ensure secure and consistent governance across all accounts, enforce service control policies (SCPs), and streamline account provisioning. Which solution would best meet these requirements?
- A
Use AWS Control Tower to set up and manage a multi-account environment with pre-configured governance.
- B
Manually create AWS Organizations and configure SCPs for each account individually.
- C
Use AWS IAM Roles to centrally manage permissions across all accounts without using AWS Organizations.
- D
Leverage AWS Config in each account to enforce governance and ensure compliance.
Show answer and explanation
Correct answer: A
Explanation
AWS Control Tower is the recommended solution for setting up and managing a secure multi-account strategy in AWS. It integrates with AWS Organizations, enforces SCPs, and provides automated account provisioning and governance, making it ideal for multi-account setups where security and consistency are key.
- A. Correct.
AWS Control Tower is designed to help you set up and manage a multi-account environment with governance best practices, including SCP enforcement, account provisioning, and compliance monitoring.
- B. Incorrect.
While AWS Organizations can be used to manage accounts and SCPs, manually configuring SCPs for each account individually is error-prone and doesn’t provide the streamlined, automated governance features that AWS Control Tower offers.
- C. Incorrect.
AWS IAM Roles are useful for managing cross-account access but do not provide governance, SCP enforcement, or centralized account provisioning.
- D. Incorrect.
AWS Config helps monitor compliance and resource changes but does not provide a centralized mechanism for account provisioning or SCP enforcement across multiple accounts.