A solutions architect is establishing a multi-account governance structure using AWS Organizations. The security architecture requires that corporate permission guardrails are active and applied to all member accounts immediately upon their inclusion in the organization, preventing any temporary window of non-compliance. What is the correct sequence of steps to configure this organizational structure?
- 1Enable AWS Organizations from the designated management account with all features enabled.
- 2Design and create the Organizational Unit (OU) hierarchy to align with the enterprise's governance needs.
- 3Author the Service Control Policies (SCPs) in the management account to define maximum allowable permissions.
- 4Attach the Service Control Policies (SCPs) to the appropriate target Organizational Units (OUs).
- 5Provision new member accounts or invite existing accounts, placing them directly into the configured Organizational Units (OUs).
Answer
The correct sequence is to first enable AWS Organizations, design and create the Organizational Unit hierarchy, author the Service Control Policies, attach these policies to the target Organizational Units, and finally provision or move member accounts into their respective Organizational Units.
The correct order establishes the management boundary (AWS Organizations), creates the logical containment structure (OUs), authors the policy guardrails (SCPs), applies the policies to the containers (OUs), and finally populates the containers with member accounts. This workflow ensures that no account exists in an OU without the governance policy already active and inherited, eliminating any window of vulnerability.
Step-by-Step Solution
Key Concept
Enforcing immediate policy inheritance in AWS Organizations by attaching Service Control Policies (SCPs) to Organizational Units (OUs) prior to moving or provisioning member accounts.
Estimated Time:2m 0s