SCS-C02 · Question #285
A company wants to gain better control of its large number of AWS accounts by establishing a centralized location where the accounts can be managed. The company also wants to prevent any users…
The correct answer is C. Create an organization in AWS Organizations. Invite the AWS accounts to join the organization. Once all the AWS accounts are invited to the organization, you can define the aws:PrincipalOrgID condition and set the value to your organization ID in the S3 bucket policy. Then only the accounts in your Organization can access the S3 bucket and any new account also will have…
Question
A company wants to gain better control of its large number of AWS accounts by establishing a centralized location where the accounts can be managed. The company also wants to prevent any users outside the company-owned AWS accounts from accessing a company Amazon S3 bucket. Which solution meets these requirements with the LEAST amount of operational overhead?
Options
- AImplement an organization in AWS Organizations. Build a detective control by monitoring AWS
- BDeploy an AWS Control Tower landing zone, and migrate the accounts. Create an S3 bucket
- CCreate an organization in AWS Organizations. Invite the AWS accounts to join the organization.
- DInvite all of the company's AWS accounts into AWS Control Tower. Use AWS Control Tower's
How the community answered
(32 responses)- A9% (3)
- B3% (1)
- C72% (23)
- D16% (5)
Explanation
Once all the AWS accounts are invited to the organization, you can define the aws:PrincipalOrgID condition and set the value to your organization ID in the S3 bucket policy. Then only the accounts in your Organization can access the S3 bucket and any new account also will have the same policy applied. https://aws.amazon.com/blogs/security/control-access-to-aws-resources-by-using-the-aws- organization-of-iam-principals/
Topics
Community Discussion
No community discussion yet for this question.