Examkin

Question

Difficulty: MediumMulti-Account Governance and Organizational Structure

An enterprise is setting up a new multi-account environment using AWS Organizations to support multiple development teams. The security team requires central auditing, compliance guardrails, and centralized network administration. Arrange the steps in the correct logical sequence to establish this governed multi-account structure.

  1. 1Create Organizational Units (OUs) for Security, Infrastructure, and Workloads in the AWS Organizations management account.
  2. 2Designate a dedicated Security account as the delegated administrator for AWS CloudTrail to centralize organization-wide trail management.
  3. 3Attach Service Control Policies (SCPs) to the Workloads OU to enforce guardrails, such as restricting regions and preventing member accounts from leaving the organization.
  4. 4Share VPC subnets from the Infrastructure account with the Workloads OU using AWS Resource Access Manager (RAM) to allow development teams to deploy resources.

Answer

The correct sequence of steps to establish the governed multi-account structure is: first, create the Organizational Units (OUs); second, configure the delegated administrator for central logging; third, apply Service Control Policies (SCPs) to the OUs; and fourth, share VPC subnets using AWS Resource Access Manager (RAM).
Establishing the OUs first provides the structural hierarchy. Next, configuring delegated administration for CloudTrail guarantees all actions are audited from the start. Then, applying SCPs ensures security guardrails are active. Finally, sharing network resources via AWS RAM allows workloads to deploy safely within these predefined boundaries.

Step-by-Step Solution

1
Set up the OU hierarchy in the management account.
Establishes the container structure (OUs) representing Security, Infrastructure, and Workloads.
OUs must exist first because all policy attachments, account assignments, and RAM shares target either OUs or the accounts inside them.
2
Configure delegated administration for AWS CloudTrail to the Security account.
Enables the Security account to manage the organizational trail, writing logs to a centralized S3 bucket.
Centralized auditing must be established before provisioning infrastructure resources or deploying applications to maintain compliance and capture all audit events from the beginning.
3
Draft and attach Service Control Policies (SCPs) to the Workloads OU.
Establishes top-level compliance guardrails that apply to all member accounts in that OU.
SCPs must be active before resources are provisioned or shared to ensure no user in the member accounts can perform restricted actions during setup.
4
Use AWS Resource Access Manager (RAM) in the Infrastructure account to share VPC subnets with the Workloads OU.
Enables member accounts in the Workloads OU to deploy resources in the shared subnets.
Sharing network resources is the final deployment step that allows application teams to deploy workloads inside a secure, monitored, and governed environment.

Key Concept

Establishment of a governed multi-account landing zone using AWS Organizations OUs, delegated administration, SCPs, and RAM sharing.
Estimated Time:2m 0s
Rate this question

Topics

Multi-Account Governance and Organizational Structure

More questions from this topic