Q57 — AWS SAA-C03 Ch.11

Question 57 of 100 | ← Chapter 11

Q757. A company created a new organization in AWS Organizations. The organization has multiple accounts for the company's development teams. The development team members use AWS IAM Identity Center (AWS Single Sign-On) to access the accounts. For each of the company's applications, the development teams must use a predefined application name to tag resources that are created.A solutions architect needs to design a solution that gives the development team the ability to create resources only if the application name tag has an approved value.Which solution will meet these requirements?

• A. Create an IAM group that has a conditional Allow policy that requires the application name tag to be specified for resources to be created.
• B. Create a cross-account role that has a Deny policy for any resource that has the application name tag.
• C. Create a resource group in AWS Resource Groups to validate that the tags are applied to all resources in all accounts.
• D. Create a tag policy in Organizations that has a list of allowed application names. ✓

Correct Answer: D. Create a tag policy in Organizations that has a list of allowed application names.

Explanation

To meet the requirement of allowing the development team to create resources only if the application name tag has an approved value, the most suitable solution is:D. Create a tag policy in Organizations that has a list of allowed application names.Option D provides the necessary mechanism to enforce the requirement:Create a tag policy in AWS Organizations that has a list of allowed application names:AWS Organizations allows you to create and manage tag policies at the organization level. A tag policy can define a list of allowed values for specific tags, including the application name tag in this case. By creating a tag policy with a list of approved application names, the organization can enforce that only the specified values are used for the application name tag.Here's why option D is the best choice:\1. Centralized enforcement: By creating the tag policy at the organization level, the policy is enforced across all accounts in the organization. This ensures consistent tagging practices and prevents resources from being created with unauthorized application names.\2. Tag-level control: The tag policy specifically targets the application name tag, allowing fine-grained control over the tag's values. Only the approved application names listed in the policy will be allowed, ensuring compliance with the company's requirements.Options A, B, and C are not the most suitable choices in this scenario:Option A suggests creating an IAM group with a conditional Allow policy that requires the application name tag. While IAM policies can be used to control resource creation, they are primarily focused on managing permissions for IAM users and roles. They are not well-suited for enforcing tag-based restrictions on resource creation.Option B suggests creating a cross-account role with a Deny policy for resources that have the application name tag. While IAM policies can be used to deny access to resources based on tags, this approach would require modifying the permissions on every resource in every account. It is not a scalable or efficient solution.Option C suggests creating a resource group in AWS Resource Groups to validate the presence of tags on resources. While resource groups can help organize and manage resources based on tags, they do not have built-in enforcement mechanisms for tag values. They are primarily used for grouping resources based on common attributes.Therefore, the most appropriate solution to meet the requirements is D: Create a tag policy in Organizations that has a list of allowed application names.