Examkin

Question

Difficulty: MediumMulti-Account Governance and Organizational Structure

A solutions architect is implementing region-restriction Service Control Policies (SCPs) across an organization in AWS Organizations. The architect needs to ensure that the restrictions do not disrupt existing applications or logging workflows, and that they are applied safely.

Arrange the steps in the correct order to design, test, and safely deploy the SCPs.

  1. 1Create the region-restriction Service Control Policy (SCP) in the AWS Organizations management account.
  2. 2Attach the SCP to a designated testing Organizational Unit (OU) containing sandbox and non-production accounts.
  3. 3Perform validation testing of resource deployments in both allowed and restricted regions within the test accounts.
  4. 4Attach the SCP to the production Organizational Units (OUs) to enforce compliance.
  5. 5Monitor centralized CloudTrail logs in the log archive account for policy enforcement and unexpected access denials.

Answer

The correct sequence begins with creating the SCP in the management account, followed by attaching it to a test OU. Next, validation testing is performed within the test OU, after which the policy is applied to the production OUs. Finally, centralized CloudTrail logs are monitored to verify enforcement and detect unexpected access denials.
The correct order ensures that policies are authored centrally, tested in an isolated non-production environment first, verified before being promoted to production accounts, and monitored via centralized logs to catch any unforeseen impacts.

Step-by-Step Solution

1
Create the SCP in the AWS Organizations management account.
The SCP is stored in the management account and is ready to be attached.
SCPs must be authored centrally in the Organizations management account.
2
Attach the SCP to a testing OU.
The policy takes effect only on the accounts residing in the testing OU.
Applying guardrails to a test OU prevents accidental outages in production during the testing phase.
3
Perform validation testing.
Verify that resource creation succeeds in permitted regions and fails in restricted regions.
Active testing verifies that policy logic works as intended and does not block critical infrastructure operations.
4
Attach the SCP to the production OUs.
The policy is enforced across all production accounts under those OUs.
Once the SCP is proven safe, it is applied to the production environment to meet governance requirements.
5
Monitor centralized CloudTrail logs.
Analyze blocked API actions to detect misconfigured services or applications.
Continuous auditing helps identify production applications that may require modifications or exemptions.

Key Concept

Phased implementation and validation of Service Control Policies in a multi-account structure
Rate this question

Topics

Multi-Account Governance and Organizational Structure

More questions from this topic