Answer-first summary for fast verification
Answer: Create an IAM policy than allows the launch of only t3.small EC2 instances in us-east-2.Attach the policy to the roles and groups that the developers use in the proofs account
1. Explanation for Answer D: - The solution involves creating an IAM (Identity and Access Management) policy that specifically allows the launch of only t3.small EC2 instances in the us-east-2 region. This policy will have conditions that restrict the instance type and region to ensure developers can only launch the desired EC2 instances. - By attaching this policy to the roles and groups that developers use in the project's account, you can enforce the restriction without affecting other permissions they might have. This approach provides a granular level of control over what resources developers can launch, aligning with the company's requirements. 2. The other options are not suitable for the following reasons: - Option A suggests creating a new developer account and enforcing a tagging policy for region affinity. However, this does not directly address the restriction on instance types and does not ensure that only t3.small instances can be launched. - Option B proposes creating a Service Control Policy (SCP) that denies the launch of all EC2 instances except t3.small in us-east-2. While this does restrict instance types, SCPs are more restrictive and not as flexible as IAM policies for granting permissions. - Option C involves purchasing Reserved Instances for each developer, which is not only costly but also does not provide the flexibility for developers to launch instances on-demand and does not address the region restriction.
Author: LeetQuiz Editorial Team
Ultimate access to all questions.
A company has a project that is launching Amazon EC2 instances that are larger than required.The project's account cannot be part of the company's organization in AWS Organizations due to policv restrictions to keep this activity outside of corporate IT.The company wants to allow only the launch of t3.small EC2 instances by developers in the project's account.These EC2 instances must be restricted the us-east-2 Region.What should a solutions architect do to meet these requirements ？
A
Create a new developer account.Move all EC2 instances ， users，and assets into us-east-2.Add the account to the company's organization in AWS Organization.Enforce a tagging policy that denotes Region affinity
B
Create an SCP that denies the launch of all EC2 instances except t3.small EC2 instances in us- east-2.Attach the SCP to the project's account
C
Create and purchase a t3.small EC2 Reserved Instance for each developer in us-east-2.Assign each developer a specific EC2 instanice with their name as the tag.
D
Create an IAM policy than allows the launch of only t3.small EC2 instances in us-east-2.Attach the policy to the roles and groups that the developers use in the proofs account
No comments yet.