DOP-C02 · Question #318
A company recently configured AWS Control Tower in its organization in AWS Organizations. The company enrolled all existing AWS accounts in AWS Control Tower. The company wants to ensure that all new
The correct answer is D. Call the AWS Service Catalog ProvisionProduct API operation with the details of the new AWS E. Call the Organizations EnableAWSServiceAccess API operation with the. AWS Control Tower uses AWS Service Catalog to provision new accounts through a product called "Account Factory." By calling the ProvisionProduct API, the Step Functions workflow can programmatically enroll the newly created AWS account into AWS Control Tower using the Account Fac
Question
A company recently configured AWS Control Tower in its organization in AWS Organizations. The company enrolled all existing AWS accounts in AWS Control Tower. The company wants to ensure that all new AWS accounts are automatically enrolled in AWS Control Tower. The company has an existing AWS Step Functions workflow that creates new AWS accounts and performs any actions required as part of account creation. The Step Functions workflow is defined in the same AWS account as AWS Control Tower. Which combination of steps should the company add to the Step Functions workflow to meet these requirements? (Choose two.)
Options
- ACreate an Amazon EventBridge event that has an aws.controltower source and a
- BCreate an Amazon EventBridge event that has an aws.controltower source and a
- CCreate an AWSControlTowerExecution role in the new AWS account. Configure the role to allow
- DCall the AWS Service Catalog ProvisionProduct API operation with the details of the new AWS
- ECall the Organizations EnableAWSServiceAccess API operation with the
How the community answered
(36 responses)- A3% (1)
- B8% (3)
- C14% (5)
- D75% (27)
Explanation
AWS Control Tower uses AWS Service Catalog to provision new accounts through a product called "Account Factory." By calling the ProvisionProduct API, the Step Functions workflow can programmatically enroll the newly created AWS account into AWS Control Tower using the Account Factory, ensuring compliance with the organization's governance policies. AWS Control Tower relies on AWS Organizations to manage accounts. To allow AWS Control Tower to manage and enroll new accounts, the EnableAWSServiceAccess API must be called with the controltower.amazonaws.com service name. This API call ensures that AWS Control Tower has the necessary permissions to manage the new account within the organization. By these steps, the company ensures that new accounts are automatically enrolled in AWS Control Tower with the necessary permissions for management.
Topics
Community Discussion
No community discussion yet for this question.