Examkin

Question

Difficulty: EasyMulti-Account Governance and Organizational Structure

A company is setting up a new multi-account environment using AWS Organizations to host its workloads. The solutions architect needs to establish basic governance and security guardrails across all accounts while organizing the accounts based on their environments (production and development). Which two actions should the solutions architect take to meet these requirements?

  1. Enable all features in AWS Organizations and use Organizational Units (OUs) to group accounts based on their environment type.Answer
  2. Apply Service Control Policies (SCPs) to the Organizational Units (OUs) to establish maximum permission guardrails.Answer
  3. C
    Attach Service Control Policies (SCPs) directly to IAM users inside the member accounts to grant them access to specific AWS services.
  4. D
    Share the default AWS-managed KMS key for Amazon S3 (aws/s3) from the management account to the member accounts to centralize S3 encryption.
  5. E
    Create a Route 53 Private Hosted Zone in the management account and rely on it to automatically resolve DNS queries for VPCs in all member accounts without VPC association.

Answer

Enable all features in AWS Organizations and use Organizational Units (OUs) to group accounts based on their environment type, and apply Service Control Policies (SCPs) to the OUs to establish maximum permission guardrails.
The correct approach involves enabling all features in AWS Organizations to group accounts by environment using OUs, and then applying Service Control Policies (SCPs) to those OUs to establish maximum permission boundaries. This matches the standard AWS multi-account governance framework.

Step-by-Step Solution

1
Identify the organizational requirements for grouping accounts and setting permission limits.
Determined that OUs should be used for grouping by environment type, and SCPs should be used for guardrails.
AWS Organizations requires 'All Features' enabled to use SCPs, and OUs are the primary administrative boundary for applying these policies collectively.
2
Determine the correct target for SCP application.
SCPs are applied at the Root, OU, or Account level, not to individual IAM users.
SCPs are organization-level policy constructs rather than identity-based policies.
3
Evaluate the limitations of AWS-managed KMS keys and Route 53 Private Hosted Zones.
Recognized that AWS-managed keys cannot be shared cross-account, and PHZs require explicit VPC association.
Standard AWS cross-account resource limitations require customer-managed keys for KMS sharing and explicit association for private DNS resolution.

Key Concept

Multi-account governance using AWS Organizations, OUs, and Service Control Policies (SCPs)
Rate this question

Topics

Multi-Account Governance and Organizational Structure

More questions from this topic