DOP-C02 · Question #341
A company uses an organization in AWS Organizations to manage its 500 AWS accounts. The organization has all features enabled. The AWS accounts are in a single OU. The developers need to use the…
The correct answer is A. Create an SCP that prevents the creation of EC2 instances without the CostCenter tag key. Service Control Policies (SCPs) can be used to prevent the creation of EC2 instances without a required tag, such as the CostCenter tag. This ensures that any new EC2 instance created in the organization must include the CostCenter tag key. Tag policies allow you to define…
Question
A company uses an organization in AWS Organizations to manage its 500 AWS accounts. The organization has all features enabled. The AWS accounts are in a single OU. The developers need to use the CostCenter tag key for all resources in the organization's member accounts. Some teams do not use the CostCenter tag key to tag their Amazon EC2 instances. The cloud team wrote a script that scans all EC2 instances in the organization's member accounts. If the EC2 instances do not have a CostCenter tag key, the script will notify AWS account administrators. To avoid this notification, some developers use the CostCenter tag key with an arbitrary string in the tag value. The cloud team needs to ensure that all EC2 instances in the organization use a CostCenter tag key with the appropriate cost center value. Which solution will meet these requirements?
Options
- ACreate an SCP that prevents the creation of EC2 instances without the CostCenter tag key.
- BCreate an SCP that prevents the creation of EC2 instances without the CostCenter tag key.
- CCreate an SCP that prevents the creation of EC2 instances without the CostCenter tag key.
- DCreate a tag policy that requires the CostCenter tag to be values from a known list of cost centers
How the community answered
(59 responses)- A83% (49)
- B2% (1)
- C5% (3)
- D10% (6)
Explanation
Service Control Policies (SCPs) can be used to prevent the creation of EC2 instances without a required tag, such as the CostCenter tag. This ensures that any new EC2 instance created in the organization must include the CostCenter tag key. Tag policies allow you to define rules for specific tags, such as specifying a known list of valid values for the CostCenter tag. By attaching a tag policy to the OU, you enforce that the CostCenter tag must contain a value from the approved list. This ensures that developers cannot use arbitrary values for the CostCenter tag. The existing script can be enhanced to not only scan for missing CostCenter tags but also check for invalid tag values. It can automatically remediate noncompliant resources by updating them with a default approved tag value or notifying administrators if necessary. This makes the solution proactive in fixing noncompliant resources while reducing manual intervention. By combining an SCP to enforce the presence of the CostCenter tag with a tag policy that validates the tag value against a list of approved cost centers, option A ensures both the presence and correctness of the CostCenter tag across all EC2 instances. This solution provides proactive governance while allowing the existing script to handle exceptions and enforce
Topics
Community Discussion
No community discussion yet for this question.