Soru

Zorluk: KolayMulti-Account Governance and Organizational Structure

An enterprise is planning to establish a secure multi-account structure using AWS Organizations. The solutions architect needs to set up a new organizational structure with Service Control Policies (SCPs) to restrict unauthorized services before any member accounts begin deploying workloads. Arrange the steps in the correct order to implement this multi-account governance structure safely.

  1. 1Enable AWS Organizations from the designated management account to establish the organization root.
  2. 2Create the required Organizational Units (OUs) under the organization root to represent functional boundaries.
  3. 3Create Service Control Policies (SCPs) and attach them to the newly created OUs to establish permission guardrails.
  4. 4Provision new member accounts directly within the OUs or move existing accounts into the OUs.

Cevap

The correct order to safely implement multi-account governance is: first, enable AWS Organizations from the management account; second, create the Organizational Units (OUs); third, create and attach Service Control Policies (SCPs) to the OUs; and fourth, provision or move member accounts into the secured OUs.
The correct sequence begins with initializing the AWS Organization root. Following this, the OU structure must be defined. To ensure secure-by-default behavior, SCPs are created and attached to the OUs next. Only after the OUs are secured are member accounts provisioned or moved into them, guaranteeing immediate policy enforcement.

Adım Adım Çözüm

1
Enable AWS Organizations.
The organization root is established.
This is the prerequisite step to allow any organizational configuration or member account orchestration.
2
Create Organizational Units (OUs).
A structured hierarchy of OUs is created under the root.
OUs act as the logical containers that will hold both accounts and policies.
3
Create and attach Service Control Policies (SCPs) to OUs.
Governance guardrails are applied to the containers.
Applying policies to OUs before placing accounts in them ensures that accounts are protected and restricted from the very moment they are associated with the OU.
4
Provision or move accounts into OUs.
Member accounts inherit the attached SCPs immediately.
This is the final step where the target accounts are placed within the governed structure.

Anahtar Kavram

Multi-Account Governance and Secure Lifecycle Management
Bu soruyu puanla