Examkin

Soru

Zorluk: OrtaMulti-Account Governance and Organizational Structure

An enterprise is establishing a multi-account governance framework using AWS Organizations. To comply with regulatory requirements, the solutions architect must enforce a Service Control Policy (SCP) that restricts resource provisioning to a subset of approved AWS Regions without disrupting essential global services or production workloads. Arrange the following steps in the correct order to design, test, and implement this governance control.

  1. 1Identify global services (such as AWS IAM, AWS Billing, and Amazon CloudFront) that must be exempted from the regional restriction to prevent system-wide management failures.
  2. 2Create the Service Control Policy (SCP) in the management account, configuring the Deny effect for non-approved regions and specifying the identified global services in the exclusion conditions.
  3. 3Attach the crafted SCP to a Sandbox or Testing Organizational Unit (OU) containing non-production accounts.
  4. 4Perform validation testing within the sandbox accounts to confirm that API calls in approved regions succeed, while actions in unapproved regions are blocked.
  5. 5Attach the validated SCP to production OUs containing live enterprise workloads.

Cevap

The correct order begins with identifying global services to exempt, followed by creating the Service Control Policy (SCP) in the management account, attaching it to a sandbox OU, validating the policy's behavior with test resources, and finally attaching the SCP to the production OUs.
The correct order follows standard safe deployment practices and AWS best practices for managing SCPs. You must first identify which global services to exempt to prevent locking administrative actions. Next, you author the SCP with the appropriate conditions. To ensure safety, you must test the policy inside a sandbox/test OU first, validate the expected behavior (allowing permitted regions and blocking unpermitted ones), and only then promote the policy to production OUs.

Adım Adım Çözüm

1
Identify global services that require exemption from region restrictions.
A list of global AWS services such as IAM, Billing, and Route 53.
Excluding global services is critical because they operate out of global endpoints and would otherwise fail if restricted to specific regions.
2
Create the SCP in the management account.
An SCP containing the region restriction logic and the global service exemptions.
Designing the policy rules is necessary before any testing or deployment can take place.
3
Attach the SCP to a Sandbox or Test OU.
The policy rules are active only for accounts inside the test OU.
Applying guardrails to sandbox environments first prevents accidental disruption of production workloads during the validation phase.
4
Verify and validate policy constraints by launching resources in approved and unapproved regions within the test accounts.
Confirmation that workloads operate correctly in approved regions and are successfully denied in unapproved regions.
Testing validates that the policy conditions are working as intended and do not have unintended side effects.
5
Apply the validated SCP to the Production OUs.
The compliance control is enforced across all production workloads.
Once validated in sandbox, the control can be safely promoted to production OUs to satisfy governance requirements.

Anahtar Kavram

Enforcing multi-account regional governance using Service Control Policies (SCPs) requires identifying global service exemptions and applying policy changes sequentially through sandbox environments to prevent operational disruption.
Bu soruyu puanla

Konular

Multi-Account Governance and Organizational Structure

Bu konudan daha fazla soru