DOP-C02 · Question #461
A company uses AWS Organizations, AWS Control Tower, AWS Config, and Terraform to manage its AWS accounts and resources. The company must ensure that users deploy only AWS Lambda functions that are…
The correct answer is D. Create a new SCP with a conditional statement that denies Lambda creation if lambda:VpcIds is. Use a Service Control Policy (SCP) with a Null condition on lambda:VpcIds to deny Lambda function creation or update when not VPC-attached. This enforces compliance across all accounts automatically without manual remediation, aligning with AWS Control Tower governance…
Question
A company uses AWS Organizations, AWS Control Tower, AWS Config, and Terraform to manage its AWS accounts and resources. The company must ensure that users deploy only AWS Lambda functions that are connected to a VPC in member AWS accounts. Which solution will meet these requirements with the LEAST operational effort?
Options
- AConfigure AWS Control Tower to use proactive controls (guardrails). Enable optional controls
- BCreate a new SCP that checks the lambda:VpcIds condition key for allowed values.
- CCreate a custom AWS Config rule to detect non-VPC-connected Lambda functions.
- DCreate a new SCP with a conditional statement that denies Lambda creation if lambda:VpcIds is
How the community answered
(65 responses)- A14% (9)
- B8% (5)
- C5% (3)
- D74% (48)
Explanation
Use a Service Control Policy (SCP) with a Null condition on lambda:VpcIds to deny Lambda function creation or update when not VPC-attached. This enforces compliance across all accounts automatically without manual remediation, aligning with AWS Control Tower governance recommendations.
Topics
Community Discussion
No community discussion yet for this question.