DOP-C02 · Question #360
A company uses an organization in AWS Organizations that has all features enabled to manage its AWS accounts. Amazon EQ instances run in the AWS accounts. The company requires that all current EC2 ins
The correct answer is A. Create a new SCP statement that denies the ec2:RunInstances action when the. SCP with ec2:condition key: The ec2:MetadataHttpTokens condition key can enforce the use of IMDSv2 by requiring the ec2:RunInstances action to use the MetadataHttpTokens parameter set to required. This configuration prevents instances from launching without IMDSv2 enabled. Attach
Question
A company uses an organization in AWS Organizations that has all features enabled to manage its AWS accounts. Amazon EQ instances run in the AWS accounts. The company requires that all current EC2 instances must use Instance Metadata Service Version 2 (IMDSv2). The company needs to block AWS API calls that originate from EC2 instances that do not use IMDSv2. Which solution will meet these requirements?
Options
- ACreate a new SCP statement that denies the ec2:RunInstances action when the
- BCreate a new SCP statement that denies the ec2:RunInstances action when the
- CCreate a new SCP statement that denies "*" when the ec2:RoleDelivery condition key value is
- DCreate a new SCP statement that denies when the ec2:MetadataHttpTokens condition key value
How the community answered
(34 responses)- A65% (22)
- B9% (3)
- C21% (7)
- D6% (2)
Explanation
SCP with ec2:condition key: The ec2:MetadataHttpTokens condition key can enforce the use of IMDSv2 by requiring the ec2:RunInstances action to use the MetadataHttpTokens parameter set to required. This configuration prevents instances from launching without IMDSv2 enabled. Attaching the SCP to the root of the organization: Applying this SCP at the organization root level ensures the policy applies across all accounts, meeting the requirement for all EC2 instances to
Topics
Community Discussion
No community discussion yet for this question.