Q95 — AWS SAA-C03 Ch.12

Question 95 of 100 | ← Chapter 12

Q895. A development team uses multiple AWS accounts for its development, staging, and production environments. Team members have been launching large Amazon EC2 instances that are underutilized. A solutions architect must prevent large instances from being launched in all accounts.How can the solutions architect meet this requirement with the LEAST operational overhead?

• A. Update the IAM policies to deny the launch of large EC2 instances. Apply the policies to all users.
• B. Define a resource in AWS Resource Access Manager that prevents the launch of large EC2 instances.
• C. Create an IAM role in each account that denies the launch of large EC2 instances. Grant the developers IAM group access to the role.
• D. Create an organization in AWS Organizations in the management account with the default policy.Create a service control policy (SCP) that denies the launch of large EC2 instances, and apply it to the AWS accounts. ✓

Correct Answer: D. Create an organization in AWS Organizations in the management account with the default policy.Create a service control policy (SCP) that denies the launch of large EC2 instances, and apply it to the AWS accounts.

Explanation

To prevent the launch of large EC2 instances across multiple AWS accounts with the least operational overhead, the following solution can be implemented:D. Create an organization in AWS Organizations in the management account with the default policy. Create a service control policy (SCP) that denies the launch of large EC2 instances and apply it to the AWS accounts.AWS Organizations is a service that enables the management of multiple AWS accounts within a hierarchy. By creating an organization in the management account and using the default policy, you can establish a unified control plane for managing policies across the member accounts.To prevent the launch of large EC2 instances, you can create a service control policy (SCP) that denies the launch of such instances and apply it to the AWS accounts within the organization. This SCP acts as a guardrail, preventing users in the member accounts from launching large EC2 instances.This approach offers centralized control and governance over the accounts within the organization. It allows for easy enforcement of policies across multiple accounts without the need to individually update IAM policies or roles in each account, reducing operational overhead.Option A suggests updating IAM policies to deny the launch of large EC2 instances and applying them to all users. This approach would require updating individual IAM policies for each user, which can be cumbersome and time-consuming to manage as the number of users and accounts increases.Option B suggests defining a resource in AWS Resource Access Manager (RAM) to prevent the launch of large EC2 instances. However, RAM is primarily used for sharing resources across accounts and does not provide fine-grained control over instance launches.Option C suggests creating an IAM role in each account that denies the launch of large EC2 instances and granting developers IAM group access to the role. While this approach can prevent instance launches, it requires managing IAM roles in each account and assigning individual developers to IAM groups, resulting in higher operational overhead.In summary, to meet the requirement of preventing the launch of large EC2 instances across multiple AWS accounts with the least operational overhead, creating an organization in AWS Organizations, using the default policy, and applying a service control policy (SCP) that denies the launch of large EC2 instances to the member accounts (Option D) is the appropriate solution.