An enterprise is planning to establish a secure multi-account structure using AWS Organizations. The solutions architect needs to set up a new organizational structure with Service Control Policies (SCPs) to restrict unauthorized services before any member accounts begin deploying workloads. Arrange the steps in the correct order to implement this multi-account governance structure safely.
- 1Enable AWS Organizations from the designated management account to establish the organization root.
- 2Create the required Organizational Units (OUs) under the organization root to represent functional boundaries.
- 3Create Service Control Policies (SCPs) and attach them to the newly created OUs to establish permission guardrails.
- 4Provision new member accounts directly within the OUs or move existing accounts into the OUs.
Cevap
The correct order to safely implement multi-account governance is: first, enable AWS Organizations from the management account; second, create the Organizational Units (OUs); third, create and attach Service Control Policies (SCPs) to the OUs; and fourth, provision or move member accounts into the secured OUs.
The correct sequence begins with initializing the AWS Organization root. Following this, the OU structure must be defined. To ensure secure-by-default behavior, SCPs are created and attached to the OUs next. Only after the OUs are secured are member accounts provisioned or moved into them, guaranteeing immediate policy enforcement.
Adım Adım Çözüm
Anahtar Kavram
Multi-Account Governance and Secure Lifecycle Management