SAP-C02 · Question #651
An enterprise company is building an infrastructure services platform for its users. The company has the following requirements: - Provide least privilege access to users when launching AWS…
The correct answer is B. Develop infrastructure services using AWS CloudFormation templates. Upload each template as D. Allow user IAM roles to have ServiceCatalogEndUserAccess permissions only. Use an E. Use the AWS Service Catalog TagOption Library to maintain a list of tags required by the. The company needs to build a self-service infrastructure platform with least privilege, central management, multi-account distribution, and enforced tagging for user-provisioned resources.
Question
An enterprise company is building an infrastructure services platform for its users. The company has the following requirements:
- Provide least privilege access to users when launching AWS
infrastructure so users cannot provision unapproved services.
- Use a central account to manage the creation of infrastructure
services.
- Provide the ability to distribute infrastructure services to multiple
accounts in AWS Organizations.
- Provide the ability to enforce tags on any infrastructure that is
started by users. Which combination of actions using AWS services will meet these requirements? (Choose three.)
Options
- ADevelop infrastructure services using AWS CloudFormation templates. Add the templates to a
- BDevelop infrastructure services using AWS CloudFormation templates. Upload each template as
- CAllow user IAM roles to have AWSCloudFormationFullAccess and AmazonS3ReadOnlyAccess
- DAllow user IAM roles to have ServiceCatalogEndUserAccess permissions only. Use an
- EUse the AWS Service Catalog TagOption Library to maintain a list of tags required by the
- FUse the AWS CloudFormation Resource Tags property to enforce the application of tags to any
How the community answered
(40 responses)- A25% (10)
- B57% (23)
- C5% (2)
- F13% (5)
Why each option
The company needs to build a self-service infrastructure platform with least privilege, central management, multi-account distribution, and enforced tagging for user-provisioned resources.
Storing CloudFormation templates in S3 with event notifications would require building custom service catalog functionality, which AWS Service Catalog provides as a managed service.
Developing infrastructure services using AWS CloudFormation templates and uploading them as AWS Service Catalog products allows for standardized, pre-approved infrastructure provisioning, meeting the central management and distribution requirements.
Granting `AWSCloudFormationFullAccess` violates the least privilege principle, allowing users to provision any service via CloudFormation, not just approved ones.
Granting user IAM roles `ServiceCatalogEndUserAccess` permissions only ensures users have least privilege to launch approved products from the Service Catalog, preventing them from provisioning unapproved services.
Using the AWS Service Catalog TagOption Library allows administrators to define a set of permissible tags that can be automatically applied or enforced during product provisioning, meeting the tag enforcement requirement.
While CloudFormation's `Resource Tags` property enforces tags within a template, it does not provide a centralized, library-based tag management and enforcement solution like the Service Catalog TagOption Library.
Concept tested: AWS Service Catalog for governed infrastructure provisioning
Source: https://docs.aws.amazon.com/servicecatalog/latest/adminguide/what-is-servicecatalog.html
Community Discussion
No community discussion yet for this question.