SAP-C02 · Question #593
A company orchestrates a multi-account structure on AWS by using AWS Control Tower. The company is using AWS Organizations, AWS Config, and AWS Trusted Advisor. The company has a specific OU for devel
The correct answer is A. Create a custom SCP in AWS Organizations to allow the deployment of only burstable instances. The company needs to enforce cost optimization in development accounts by restricting EC2/RDS to burstable instances and disallowing other non-relevant services, requiring a preventive control.
Question
A company orchestrates a multi-account structure on AWS by using AWS Control Tower. The company is using AWS Organizations, AWS Config, and AWS Trusted Advisor. The company has a specific OU for development accounts that developers use to experiment on AWS. The company has hundreds of developers, and each developer has an individual development account. The company wants to optimize costs in these development accounts. Amazon EC2 instances and Amazon RDS instances in these accounts must be burstable. The company wants to disallow the use of other services that are not relevant. What should a solutions architect recommend to meet these requirements?
Options
- ACreate a custom SCP in AWS Organizations to allow the deployment of only burstable instances
- BCreate a custom detective control (guardrail) in AWS Control Tower. Configure the control
- CCreate a custom preventive control (guardrail) in AWS Control Tower. Configure the control
- DCreate an AWS Config rule in the AWS Control Tower account. Configure the AWS Config rule to
How the community answered
(50 responses)- A84% (42)
- B10% (5)
- C2% (1)
- D4% (2)
Why each option
The company needs to enforce cost optimization in development accounts by restricting EC2/RDS to burstable instances and disallowing other non-relevant services, requiring a preventive control.
An AWS Organizations Service Control Policy (SCP) is a preventive control that can be applied to an Organizational Unit (OU) to explicitly deny the deployment of non-burstable EC2/RDS instances and other unwanted AWS services, thus enforcing cost optimization and security at scale.
A detective control only monitors and alerts on non-compliant resources after they have been deployed, which does not prevent unwanted services or instance types from being launched, failing to "disallow" them proactively.
While a preventive guardrail in Control Tower is the right category, an SCP is the fundamental mechanism to implement such fine-grained custom preventive policies, directly addressing the specific resource type restrictions and service denials.
An AWS Config rule is a detective control that identifies non-compliant resources after they are created, but it does not prevent their creation, which is necessary to "disallow" services and ensure only burstable instances are deployed.
Concept tested: AWS Organizations SCPs, preventive vs. detective controls, cost optimization
Source: https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html
Community Discussion
No community discussion yet for this question.