A company uses an organization in AWS Organizations to create and manage new AWS accounts. The company has a new requirement to update the alternate account contacts for billing, operations, and…

Question

Options

• ACreate an AWS Lambda function that updates the alternate contacts. Create an Amazon
• BCreate a service control policy (SCP) that updates the alternate contacts when new accounts are
• CCreate an Amazon CloudWatch alarm that publishes an Amazon Simple Notification Service
• DCreate an AWS Support case from the organization's management account. Request for AWS to

• A
  82% (18)
• B
  5% (1)
• C
  5% (1)
• D
  9% (2)

Explanation

Option A is correct because a Lambda function triggered by an Amazon EventBridge rule (on the CreateAccountResult or account lifecycle event) can automatically call the AWS Account Management API (UpdateAlternateContact) to set billing, operations, and security contacts on every new account without manual intervention - making it fully automated and scalable.

Why the distractors are wrong:

• B (SCP): SCPs govern permissions (what actions principals can take); they cannot execute API calls or update account metadata like alternate contacts.
• C (CloudWatch alarm + SNS): This would only notify a human when a new account is created, requiring manual follow-up - it doesn't automate the update itself.
• D (AWS Support case): Delegating this to AWS Support is manual, slow, and entirely contrary to operational efficiency at scale.

Memory tip: Think of SCPs as guardrails (they restrict/allow), not actors (they don't do things). Whenever a question asks you to automatically respond to an account lifecycle event in Organizations, the pattern is always EventBridge → Lambda → API call.

No community discussion yet for this question.