SAP-C02 · Question #835
A company migrated its on-premises infrastructure to the AWS Cloud. The company uses AWS Organizations and has an account designated for its developers. The company uses AWS Cost Explorer to review…
The correct answer is C. Create a new SCP in the Organizations management account that specifies the instance types. Service Control Policies (SCPs) in AWS Organizations allow you to define permissions that govern what actions can be taken in your AWS accounts. By creating a new SCP that specifies the approved instance types, you can restrict the developer account to only launch certain…
Question
A company migrated its on-premises infrastructure to the AWS Cloud. The company uses AWS Organizations and has an account designated for its developers. The company uses AWS Cost Explorer to review monthly costs. A solutions architect noticed a high cost from the creation and termination of several large instance types in the developer account. Developers launched new Amazon EC2 instances for testing but used inappropriate instance types. The solutions architect needs to implement a control mechanism that prevents developers from launching unapproved instance types. Which solution will meet these requirements?
Options
- ACreate a desired-instance-type managed rule in AWS Config. Configure the rule with the instance
- BCreate a launch template in the EC2 console that specifies the instance types that are approved.
- CCreate a new SCP in the Organizations management account that specifies the instance types
- DUse EC2 Image Builder to create an image pipeline for the developers and assist the developers
How the community answered
(48 responses)- A8% (4)
- B17% (8)
- C71% (34)
- D4% (2)
Explanation
Service Control Policies (SCPs) in AWS Organizations allow you to define permissions that govern what actions can be taken in your AWS accounts. By creating a new SCP that specifies the approved instance types, you can restrict the developer account to only launch certain instance types. This solution provides a centralized, policy-driven approach to controlling instance types, and it can be enforced at the account level in AWS Organizations. This solution prevents the launching of unapproved EC2 instances based on the instance type.
Community Discussion
No community discussion yet for this question.