SOA-C03 · Question #85
A company uses AWS Organizations to manage a set of AWS accounts. The company has set up organizational units (OUs) in the organization. An application OU supports various applications. A CloudOps…
The correct answer is B. Create a service control policy (SCP) that denies the oc2:RunInstances action when the. To enforce a mandatory tag across multiple accounts in an OU, you use a service control policy. An SCP with a Deny on ec2:RunInstances when the CostCenter-Project tag is not present will block launches of untagged instances in all accounts in that OU, regardless of local IAM…
Question
A company uses AWS Organizations to manage a set of AWS accounts. The company has set up organizational units (OUs) in the organization. An application OU supports various applications. A CloudOps engineer must prevent users from launching Amazon EC2 instances that do not have a CostCenter-Project tag into any account in the application OU. The restriction must apply only to accounts in the application OU. Which solution will meet these requirements?
Options
- ACreate an IAM group that has a policy that allows the ec2:RunInstances action when the
- BCreate a service control policy (SCP) that denies the oc2:RunInstances action when the
- CCreate an IAM role that has a policy that allows the oc2:RunInstances action when the
- DCreate a service control policy (SCP) that denies the ec2:RunInstances action when the
How the community answered
(51 responses)- A12% (6)
- B80% (41)
- C2% (1)
- D6% (3)
Explanation
To enforce a mandatory tag across multiple accounts in an OU, you use a service control policy. An SCP with a Deny on ec2:RunInstances when the CostCenter-Project tag is not present will block launches of untagged instances in all accounts in that OU, regardless of local IAM policies. Attaching it to the application OU ensures the restriction applies only there and not to other OUs or the entire organization.
Topics
Community Discussion
No community discussion yet for this question.