DOP-C02 · Question #302
A large company recently acquired a small company. The large company invited the small company to join the large company's existing organization in AWS Organizations as a new OU. A DevOps engineer…
The correct answer is A. Configure a statement to deny the ec2:RunInstances action for all EC2 instance resources when. Using a deny statement is a best practice in IAM policies, especially in Service Control Policies (SCPs). By denying the ec2:RunInstances action when the instance type is not t3.small, you ensure that users in the small company's OU cannot launch any other instance types, which…
Question
A large company recently acquired a small company. The large company invited the small company to join the large company's existing organization in AWS Organizations as a new OU. A DevOps engineer determines that the small company needs to launch t3.small Amazon EC2 instance types for the company's application workloads. The small company needs to deploy the instances only within US-based AWS Regions. The DevOps engineer needs to use an SCP in the small company's new OU to ensure that the small company can launch only the required instance types. Which solution will meet these requirements?
Options
- AConfigure a statement to deny the ec2:RunInstances action for all EC2 instance resources when
- BConfigure a statement to allow the ec2:RunInstances action for all EC2 instance resources when
- CConfigure a statement to deny the ec2:RunInstances action for all EC2 instance resources when
- DConfigure a statement to allow the ec2:RunInstances action for all EC2 instance resources when
How the community answered
(19 responses)- A74% (14)
- B5% (1)
- C16% (3)
- D5% (1)
Explanation
Using a deny statement is a best practice in IAM policies, especially in Service Control Policies (SCPs). By denying the ec2:RunInstances action when the instance type is not t3.small, you ensure that users in the small company's OU cannot launch any other instance types, which meets the requirement of restricting instance types. Adding another deny statement for the aws:RequestedRegion condition ensures that EC2 instances can only be launched in US-based AWS Regions. This restriction helps ensure compliance with the company's geographical requirements for deploying workloads. This solution provides clear and concise rules that explicitly outline what is prohibited, making it easier to understand and manage. It reduces the risk of allowing unintended actions.
Topics
Community Discussion
No community discussion yet for this question.