Examkin

Soru

Zorluk: ZorMulti-Account Governance and Organizational Structure

An enterprise is designing a secure multi-account AWS environment using AWS Organizations. The solutions architect needs to establish AWS Control Tower to govern the landing zone, apply baseline compliance controls, and deploy custom CloudFormation templates across all member accounts. Arrange the following steps in the correct chronological order to implement this multi-account governance solution.

  1. 1Design and establish the Organizational Unit (OU) hierarchy in AWS Organizations.
  2. 2Deploy AWS Control Tower in the management account to initialize the landing zone.
  3. 3Configure elective guardrails (Service Control Policies and AWS Config rules) on the target OUs.
  4. 4Provision new member accounts or enroll existing accounts into the governed OUs using Account Factory.
  5. 5Deploy the Customizations for AWS Control Tower (CfCT) framework to distribute custom resources.

Cevap

The correct sequence of steps to implement AWS Control Tower governance is: 1. Design and establish the Organizational Unit (OU) hierarchy in AWS Organizations, 2. Deploy AWS Control Tower in the management account to initialize the landing zone, 3. Configure elective guardrails on the target OUs, 4. Provision new member accounts or enroll existing accounts into the governed OUs using Account Factory, and 5. Deploy the Customizations for AWS Control Tower (CfCT) framework to distribute custom resources.
The correct implementation sequence starts with designing and establishing the Organizational Unit (OU) structure to define account boundaries. Next, AWS Control Tower is deployed to establish the landing zone control plane. Once the landing zone is active, guardrails must be configured on the OUs to define baseline security boundaries. After the guardrails are active, new or existing accounts are provisioned or enrolled via Account Factory to inherit the baseline guardrails. Finally, the Customizations for AWS Control Tower (CfCT) framework is deployed to apply additional localized configurations and custom AWS resources to the governed accounts.

Adım Adım Çözüm

1
Design and establish the OU hierarchy in AWS Organizations.
The target container structure for accounts is defined.
This provides the structure that AWS Control Tower and member accounts will utilize.
2
Deploy AWS Control Tower in the management account.
The landing zone is created along with core shared accounts (Log Archive and Audit).
This establishes the core control plane and governance framework.
3
Configure elective guardrails on the target OUs.
Service Control Policies (SCPs) and Config rules are activated for the OUs.
Applying guardrails early ensures subsequent accounts are immediately protected.
4
Provision or enroll accounts into the governed OUs using Account Factory.
Member accounts are added to the organization and inherit the OU guardrails.
Accounts must exist under governed OUs to receive configurations and baseline governance.
5
Deploy the Customizations for AWS Control Tower (CfCT) framework.
A pipeline is established to deploy custom resources and localized policies across accounts.
CfCT depends on the completed landing zone infrastructure and active member accounts to target resources.

Anahtar Kavram

AWS Control Tower multi-account landing zone establishment and governance workflow.
Bu soruyu puanla

Konular

Multi-Account Governance and Organizational Structure

Bu konudan daha fazla soru