SAP-C02 · Question #537
A company is expanding. The company plans to separate its resources into hundreds of different AWS accounts in multiple AWS Regions. A solutions architect must recommend a solution that denies…
The correct answer is C. Launch an AWS Control Tower landing zone. Create OUs and attach SCPs that deny access to. To deny access to any operations outside of specifically designated AWS Regions across hundreds of accounts in an expanding organization, AWS Control Tower with OUs and SCPs is the recommended solution.
Question
A company is expanding. The company plans to separate its resources into hundreds of different AWS accounts in multiple AWS Regions. A solutions architect must recommend a solution that denies access to any operations outside of specifically designated Regions. Which solution will meet these requirements?
Options
- ACreate IAM roles for each account. Create IAM policies with conditional allow permissions that
- BCreate an organization in AWS Organizations. Create IAM users for each account. Attach a policy
- CLaunch an AWS Control Tower landing zone. Create OUs and attach SCPs that deny access to
- DEnable AWS Security Hub in each account. Create controls to specify the Regions where an
How the community answered
(56 responses)- A7% (4)
- B4% (2)
- C77% (43)
- D13% (7)
Why each option
To deny access to any operations outside of specifically designated AWS Regions across hundreds of accounts in an expanding organization, AWS Control Tower with OUs and SCPs is the recommended solution.
Creating and managing IAM roles and policies with conditional allow permissions for each of hundreds of accounts is not scalable and would be operationally complex and error-prone.
Creating IAM users for each account and attaching policies individually is not scalable or efficient for hundreds of accounts, and IAM policies are not as robust as SCPs for organization-wide restrictions.
AWS Control Tower helps set up and govern a secure, multi-account AWS environment and integrates with AWS Organizations. By creating Organizational Units (OUs) and attaching Service Control Policies (SCPs) to them, a solutions architect can centrally define and enforce guardrails, such as denying access to operations outside designated Regions, across all accounts within those OUs. This provides a high-level, preventative control that applies to all IAM users and roles in the affected accounts.
AWS Security Hub is a security posture management service that aggregates findings and monitors security best practices; it does not enforce region restrictions or prevent actions from being taken.
Concept tested: Centralized multi-account region restriction using SCPs
Source: https://aws.amazon.com/controltower/
Community Discussion
No community discussion yet for this question.