DOP-C02 · Question #344
A company is using AWS Organizations and wants to implement a governance strategy with the following requirements: - AWS resource access is restricted to the same two Regions for all accounts. - AWS…
The correct answer is D. Establish a service control policy in the management account to restrict Regions and authorized. Service Control Policies (SCPs) are the appropriate tool for enforcing governance in AWS Organizations. SCPs allow you to restrict AWS resources, services, and regions across all accounts in an organization. By setting an SCP, you can ensure that access to AWS resources is…
Question
A company is using AWS Organizations and wants to implement a governance strategy with the following requirements:
- AWS resource access is restricted to the same two Regions for all
accounts.
- AWS services are limited to a specific group of authorized services
for all accounts.
- Authentication is provided by Active Directory.
- Access permissions are organized by job function and are identical in
each account. Which solution will meet these requirements?
Options
- AEstablish an organizational unit (OU) with group policies in the management account to restrict
- BEstablish a permission boundary in the management account to restrict Regions and authorized
- CEstablish a service control policy in the management account to restrict Regions and authorized
- DEstablish a service control policy in the management account to restrict Regions and authorized
How the community answered
(34 responses)- A12% (4)
- B6% (2)
- C24% (8)
- D59% (20)
Explanation
Service Control Policies (SCPs) are the appropriate tool for enforcing governance in AWS Organizations. SCPs allow you to restrict AWS resources, services, and regions across all accounts in an organization. By setting an SCP, you can ensure that access to AWS resources is limited to the specific two regions and that only the authorized AWS services can be used. SCPs are applied at the organizational level and govern what IAM users and roles within an account can do, providing a strong governance mechanism. CloudFormation StackSets are ideal for deploying IAM roles and permissions consistently across multiple accounts in AWS Organizations. You can define roles that are organized by job function and ensure that these roles are provisioned identically in each account. This simplifies management by creating consistent access policies across all accounts. The solution mentions using an IAM trust policy for IAM identity provider authentication, which allows you to integrate Active Directory with AWS for authentication. By configuring a trust relationship, the accounts can authenticate with Active Directory Federation Services (ADFS) or another compatible identity provider (IdP), ensuring centralized authentication for users across By using SCPs for governance and CloudFormation StackSets for consistent role provisioning, this solution provides an efficient and scalable approach to meet the company's governance, regional restrictions, service limitations, and centralized authentication requirements.
Topics
Community Discussion
No community discussion yet for this question.