A company is migrating its entire IT portfolio to AWS. The company requires a centralized payment management solution for several business units. The solution must provide visibility into each…

Question

Options

• AUse a collection of parameterized AWS CloudFormation templates to define common IAM
• BUse AWS Organizations to create a new organization from a payer account. Define an OU
• CConsolidate all of the company's business units into a single AWS account. Use tags to track
• DEnsure that each business unit continues to use its own AWS account. Tag each AWS account
• EEnable all features of AWS Organizations. Establish appropriate SCPs that filter IAM permissions

• A
  6% (2)
• B
  72% (23)
• C
  19% (6)
• D
  3% (1)

Explanation

You can meet the requirements by setting up a central AWS Organizations structure with a payer account that manages all other accounts. Each business unit keeps its own account, which gives visibility into individual spending while consolidating billing at the organizational level. Then, by enabling all features in AWS Organizations, you can create and attach Service Control Policies (SCPs) that centrally enforce IAM restrictions across the organization. This provides the security team with a single point of governance for IAM usage, while still allowing workloads such as production systems to run in dedicated, isolated accounts.

No community discussion yet for this question.