Answer-first summary for fast verification
Answer: Enable AWS Organizations, attach the AWS accounts, and create OUs tor European Regions and non- European Regions. Create SCPs to limit access to non-European Regions and attach the policies to the OUs.
Option B is the correct answer due to the following reasons: 1. **AWS Organizations and Management**: - Enabling AWS Organizations allows the company to manage multiple AWS accounts centrally. This helps in applying policies and restrictions across all accounts under an organization. - Creating Organizational Units (OUs) within AWS Organizations helps to segregate accounts. In this scenario, separating accounts into OUs for European Regions and non-European Regions simplifies management and policy application. 2. **Service Control Policies (SCPs)**: - SCPs are a type of policy that you can use within AWS Organizations to manage permissions across all accounts in your organization. SCPs can prevent member accounts from performing restricted actions regardless of the policies that are directly attached to IAM users or roles in those accounts. - By creating SCPs to limit access to non-European Regions and attaching these policies to the appropriate OUs, you ensure that the developers' access is compliant with the data privacy law. SCPs provide a strong guardrail by preventing any member account from circumventing restrictions, ensuring compliance. 3. **Least Management Overhead**: - By centralizing management using AWS Organizations and SCPs, there is a streamlined and consistent method to apply the required restrictions, thus significantly reducing the per-account management overhead. - Other options like managing individual IAM policies in each account (as in Option A) or setting up service like AWS Single Sign-On across multiple accounts (as in Option C) or combining IAM and permission sets strategies (as in Option D) would result in more complex and higher management overhead.
Author: LeetQuiz Editorial Team
Ultimate access to all questions.
No comments yet.
A large company in Europe plans to migrate its applications to the AWS Cloud. The company uses multiple AWS accounts for various business group. A data privacy law requires the company to restrict developers' access to AWS European Regions only. What should the solutions architect do to meet this requirement with the LEAST amount of management overhead?
A
Create IAM users and IAM groups in each account. Create IAM policies to limit access to non-European Regions. Attach the IAM policies to the IAM groups.
B
Enable AWS Organizations, attach the AWS accounts, and create OUs tor European Regions and non- European Regions. Create SCPs to limit access to non-European Regions and attach the policies to the OUs.
C
Set up AWS Single Sign-On and attach AWS accounts. Create permission sets with policies to restrict access to non-European Regions. Create IAM users and IAM groups in each account.
D
Enable AWS Organizations, attach the AWS accounts, and create OUs for European Regions and non- European Regions. Create permission sets with policies to restrict access lo non-European Regions. Create IAM users and IAM groups in the primary account.