Examkin

Question

Difficulty: HardMulti-Account Governance and Organizational Structure

An enterprise is planning to establish a governed, multi-account AWS environment using AWS Organizations and AWS Control Tower. The strategy requires centralized logging, centralized security operations, environment segregation, and service control guardrails before workloads are deployed. Arrange the following steps in the correct chronological sequence to implement this multi-account governance strategy according to AWS best practices.

  1. 1Initialize AWS Organizations in the management account to create the organizational root and enable all feature sets.
  2. 2Deploy AWS Control Tower in the management account to establish the landing zone baseline and provision core accounts, including the Log Archive and Security Tooling accounts.
  3. 3Designate the newly provisioned Security Tooling account as the delegated administrator for organizational security services.
  4. 4Establish custom Organizational Units (OUs) to group workloads and separate production, staging, and development environments.
  5. 5Create and attach custom Service Control Policies (SCPs) to the custom OUs to restrict prohibited Regions and actions before provisioning workload accounts.

Answer

The correct order is: Initialize AWS Organizations, deploy AWS Control Tower, designate the Security Tooling account as the delegated administrator, establish custom OUs, and attach custom Service Control Policies (SCPs).
The correct sequence begins with initializing the AWS Organization to build the administrative root. Next, deploying AWS Control Tower provisions the Security OU along with the Log Archive and Security Tooling accounts. Once these core accounts are active, the Security Tooling account is designated as the delegated administrator for security services. Custom OUs are then created to group future workload accounts, and finally, custom SCPs are attached to these OUs to enforce boundaries before the member accounts are provisioned.

Step-by-Step Solution

1
Initialize AWS Organizations
The administrative root is created, enabling multi-account management features.
This establishes the organizational structure and API capabilities required by orchestration tools.
2
Deploy AWS Control Tower
A multi-account landing zone is created with dedicated Security OUs containing Log Archive and Security Tooling accounts.
Control Tower sets up the foundational security baseline and logs account before custom workloads or configurations can be applied.
3
Designate Delegated Administrator
Security services are centralized in the Security Tooling account rather than the Management account.
Best practices dictate delegating administration to security-specific accounts rather than performing daily security operations in the management account.
4
Establish Custom OUs
New OUs (e.g., Workloads, Sandbox) are added to the hierarchy.
OUs must exist in the hierarchy before you can assign accounts or attach policies to them.
5
Attach Service Control Policies (SCPs)
Custom guardrails are applied to target OUs.
Enforcing policies at the OU level before accounts are provisioned guarantees that new accounts are immediately governed by the guardrails.

Key Concept

Foundational multi-account setup sequence and delegation of administrative control under AWS Organizations.

Alternative Method

An alternative approach is using Infrastructure as Code (IaC) with AWS Control Tower Account Factory for Terraform (AFT) to automate this pipeline, where the organization bootstrap, landing zone deployment, and customized OU policies are defined declaratively.
Estimated Time:3m 0s
Rate this question

Topics

Multi-Account Governance and Organizational Structure

More questions from this topic