SAP-C02 · Question #616
A company has a project that is launching Amazon EC2 instances that are larger than required. The project's account cannot be part of the company's organization in AWS Organizations due to policy rest
The correct answer is D. Create an IAM policy than allows the launch of only t3.small EC2 instances in us-east-2. Attach. To restrict developers in a project account to launching only t3.small EC2 instances in us-east-2, an IAM policy must be created and attached to their identities.
Question
A company has a project that is launching Amazon EC2 instances that are larger than required. The project's account cannot be part of the company's organization in AWS Organizations due to policy restrictions to keep this activity outside of corporate IT. The company wants to allow only the launch of t3.small EC2 instances by developers in the project's account. These EC2 instances must be restricted to the us-east-2 Region. What should a solutions architect do to meet these requirements?
Options
- ACreate a new developer account. Move all EC2 instances, users, and assets into us-east-2. Add
- BCreate an SCP that denies the launch of all EC2 instances except t3.small EC2 instances in us-
- CCreate and purchase a t3.small EC2 Reserved Instance for each developer in us-east-2. Assign
- DCreate an IAM policy than allows the launch of only t3.small EC2 instances in us-east-2. Attach
How the community answered
(23 responses)- A9% (2)
- B4% (1)
- C9% (2)
- D78% (18)
Why each option
To restrict developers in a project account to launching only t3.small EC2 instances in us-east-2, an IAM policy must be created and attached to their identities.
Creating a new developer account and moving assets is a migration task and does not, by itself, enforce restrictions on instance types or regions that can be launched.
Service Control Policies (SCPs) are part of AWS Organizations and cannot be applied to an account that is explicitly outside of the company's organization, as stated in the question.
Purchasing Reserved Instances is a cost optimization strategy that provides a billing discount, but it does not technically restrict users from launching other, more expensive instance types.
An IAM policy can explicitly define conditions for the `ec2:RunInstances` action, allowing it only for specific instance types (like `t3.small`) and within specific AWS Regions (like `us-east-2`). Attaching this policy to the developers' IAM users or roles effectively enforces the required restrictions at the identity level within the account.
Concept tested: IAM policies for EC2 instance launch restrictions
Source: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policies-for-amazon-ec2.html
Community Discussion
No community discussion yet for this question.