Q74 — AWS SAA-C03 Ch.10

Question 74 of 100 | ← Chapter 10

Q674. A company needs a solution to prevent AWS CloudFormation stacks from deploying AWS Identity and Access Management (IAM) resources that include an inline policy or "" in the statement. The solution must also prohibit deployment of Amazon EC2 instances with public IP addresses. The company has AWS Control Tower enabled in its organization in AWS Organizations.Which solution will meet these requirements?

Correct Answer: A. Use AWS Control Tower proactive controls to block deployment of EC2 instances with public IP addresses and inline policies with elevated access or "'

Explanation

To meet the requirements of preventing AWS CloudFormation stacks from deploying IAM resources with inline policies or "", as well as prohibiting the deployment of EC2 instances with public IP addresses, while taking advantage of AWS Control Tower in an AWS Organizations setup, the solution that would best fit these criteria is:A. Use AWS Control Tower proactive controls to block deployment of EC2 instances with public IP addresses and inline policies with elevated access or "".Here's the rationale behind this solution:Option A: Use AWS Control Tower proactive controls to block deployment of EC2 instances with public IP addresses and inline policies with elevated access or "". AWS Control Tower provides proactive controls that can be used to define policies and enforce them across your AWS accounts within the organization. By leveraging these proactive controls, you can set up policies that specifically block the deployment of EC2 instances with public IP addresses and IAM resources that contain inline policies or "" statements.This solution is the most appropriate because it aligns with the requirements and leverages the capabilities provided by AWS Control Tower. It allows you to enforce the desired restrictions without requiring additional custom development or configurations.Option B: Use AWS Control Tower detective controls to block deployment of EC2 instances with public IP addresses and inline policies with elevated access or "". AWS Control Tower detective controls are designed to identify potential security risks and compliance violations, rather than actively blocking deployments. While they can provide insights into potential issues, they do not directly prevent the deployment of EC2 instances with public IP addresses or IAM resources with inline policies or "".Option C: Use AWS Config to create rules for EC2 and IAM compliance. Configure the rules to run an AWS Systems Manager Session Manager automation to delete a resource when it is not compliant. AWS Config is a service that allows you to assess, audit, and evaluate the configurations of your AWS resources. While it can help identify noncompliant resources, it does not actively block the deployment of EC2 instances with public IP addresses or IAM resources with inline policies or "". Automating the deletion of resources using AWS Systems Manager Session Manager is not an appropriate method for preventing the initial deployment of noncompliant resources.Option D: Use a service control policy (SCP) to block actions for the EC2 instances and IAM resources if the actions lead to noncompliance.Service Control Policies (SCPs) are used to manage permissions and access control at the root level of an AWS Organization. While they can help enforce certain policies, they are not designed to specifically prevent the deployment of EC2 instances with public IP addresses or IAM resources with inline policies or "". SCPs have a broader scope and are not as granular as the proactive controls provided by AWS Control Tower.Therefore, the most suitable solution that meets the requirements is to use AWS Control Tower proactive controls to block the deployment of EC2 instances with public IP addresses and inline policies with elevated access or "" (Option A). This solution aligns with the desired restrictions, leverages the capabilities provided by AWS Control Tower, and does not require additional custom development or configurations.