SAP-C02 · Question #23
A company has a project that is launching Amazon EC2 instances that are larger than required. The project's account cannot be part of the company's organization in AWS Organizations due to policy…
The correct answer is D. Create an IAM policy than allows the launch of only t3.small EC2 instances in us-east-2. Attach. To restrict EC2 instance launches to specific types and regions for developers within a standalone AWS account, an IAM policy attached to the developers' roles or groups is the appropriate and most direct solution. This policy can explicitly allow only t3.small instances in…
Question
A company has a project that is launching Amazon EC2 instances that are larger than required. The project's account cannot be part of the company's organization in AWS Organizations due to policy restrictions to keep this activity outside of corporate IT. The company wants to allow only the launch of t3.small EC2 instances by developers in the project's account. These EC2 instances must be restricted to the us-east-2 Region. What should a solutions architect do to meet these requirements?
Options
- ACreate a new developer account. Move all EC2 instances, users, and assets into us-east-2. Add
- BCreate an SCP that denies the launch of all EC2 instances except I3.small EC2 instances in us-
- CCreate and purchase a t3.small EC2 Reserved Instance for each developer in us-east-2. Assign
- DCreate an IAM policy than allows the launch of only t3.small EC2 instances in us-east-2. Attach
How the community answered
(46 responses)- A4% (2)
- B9% (4)
- C13% (6)
- D74% (34)
Why each option
To restrict EC2 instance launches to specific types and regions for developers within a standalone AWS account, an IAM policy attached to the developers' roles or groups is the appropriate and most direct solution. This policy can explicitly allow only `t3.small` instances in `us-east-2`.
Creating a new account and moving assets is an organizational task, not a direct solution for preventing the launch of specific EC2 instance types or restricting regions through policy.
Service Control Policies (SCPs) are features of AWS Organizations and cannot be applied to accounts that are not part of an organization, as explicitly stated in the question.
Purchasing Reserved Instances is a cost-saving measure that does not prevent users from launching other, larger instance types or in different regions; it only provides a discount for the specified instance type and region.
An IAM policy can be crafted within the project's AWS account to explicitly define permissions for `ec2:RunInstances`, including conditions that restrict the `ec2:InstanceType` to `t3.small` and the `aws:RequestedRegion` to `us-east-2`, thus enforcing the desired launch restrictions for developers.
Concept tested: IAM policies for EC2 instance type and region restrictions
Source: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-ec2
Community Discussion
No community discussion yet for this question.