Examkin

Question

Difficulty: EasyMulti-Account Governance and Organizational Structure

A solutions architect is tasked with restricting member accounts from performing unauthorized actions across a newly created AWS Organization. The architect decides to use Service Control Policies (SCPs) to enforce these boundaries. To implement this governance control, in what order should the steps be performed?

  1. 1Create the AWS Organization from the management account.
  2. 2Enable the Service Control Policies (SCPs) feature in the organization settings.
  3. 3Create the custom Service Control Policy (SCP) document.
  4. 4Attach the Service Control Policy (SCP) to the target Organizational Unit (OU).

Answer

The correct sequence is to first create the AWS Organization, enable the Service Control Policies feature within the organization settings, author the custom policy document, and then attach the policy to the target Organizational Unit.
Establishing governance using SCPs requires first setting up the AWS Organization. The Service Control Policies feature must then be enabled in the organization settings since it is disabled by default. Once enabled, the custom policy defining the governance limits must be created, and finally, the policy must be attached to the target Organizational Unit (OU) to enforce the rules on member accounts.

Step-by-Step Solution

1
Initialize the AWS Organization.
The Organization is created, and the management account is established.
You cannot manage policies or organize accounts before the organization environment exists.
2
Enable the Service Control Policies policy type.
SCPs are activated and ready to be applied.
SCPs are disabled by default in newly created organizations.
3
Create the custom SCP document.
The SCP document with the defined policy rules is stored in the account.
A policy must exist before you can select it to attach to target nodes.
4
Attach the policy.
The policy is attached to the target OU, applying the restrictions to all member accounts inside.
Creating a policy does not enforce it; it must be explicitly attached to target OUs or accounts.

Key Concept

Enabling and applying Service Control Policies (SCPs) within AWS Organizations governance workflows.
Estimated Time:45s
Rate this question

Topics

Multi-Account Governance and Organizational Structure

More questions from this topic