A company is designing the architecture for a new mobile app that uses the AWS Cloud. The company uses organizational units (OUs) in AWS Organizations to manage its accounts. The company wants to…

Question

Options

• AIn Organizations, create a new tag policy that specifies the data sensitivity tag key and the
• BIn Organizations, create a new service control policy (SCP) that specifies the data sensitivity tag
• CCreate a tag policy to deny running instances when a tag key is not specified. Create another tag
• DCreate a service control policy (SCP) to deny creating instances when a tag key is not specified.
• ECreate an AWS Config rule to check if EC2 instances use the data sensitivity tag and the

• A
  82% (31)
• B
  5% (2)
• C
  11% (4)
• E
  3% (1)

Explanation

To meet the requirements for tagging and preventing instance creation or deletion without proper tags, the company can use a combination of AWS Organizations tag policies and service control policies (SCPs). Tag Policies: These enforce specific tag values across resources. Creating a tag policy with required values (e.g., sensitive, non-sensitive) and attaching it to the appropriate organizational unit (OU) ensures consistency in tagging. SCPs: SCPs can be used to enforce compliance by preventing instance creation without a tag and preventing tag deletion. These policies control actions at the account level across the Key AWS features: Tag Policieshelp standardize tags across accounts, andSCPsenforce governance by restricting actions that violate the policies. AWS Documentation: AWS best practices recommend using tag policies and SCPs to enforce compliance across multiple accounts within AWS Organizations.

No community discussion yet for this question.