Topic 1 Question 334
3 つ選択A company use an organization in AWS Organizations to manage multiple AWS accounts. The company has enabled all features enabled for the organization. The company configured the organization as a hierarchy of OUs under the root OU. The company recently registered all its OUs and enrolled all its AWS accounts in AWS Control Tower.
The company needs to customize the AWS Control Tower managed AWS Config configuration recorder in each of the company's AWS accounts. The company needs to apply the customizations to both the existing AWS accounts and to any new AWS accounts that the company enrolls in AWS Control Tower in the future.
Which combination of steps will meet these requirements?
Create a new AWS account. Create an AWS Lambda function in the new account to apply the customizations to the AWS Config configuration recorder in each AWS account in the organization.
Create a new AWS account as an AWS Config delegated administrator. Create an AWS Lambda function in the delegated administrator account to apply the customizations to the AWS Config configuration recorder in the delegated administrator account.
Configure an Amazon EventBridge rule in the AWS Control Tower management account to invoke an AWS Lambda function when the Organizations OU is registered or reregistered. Re-register the root Organizations OU.
Configure the AWSControlTowerExecution IAM role in each AWS account in the organization to be assumable by an AWS Lambda function. Configure the Lambda function to assume the AWSControlTowerExecution IAM role.
Create an IAM role in the AWS Control Tower management account that an AWS Lambda function can assume. Grant the IAM role permission to assume the AWSControlTowerExecution IAM role in any account in the organization. Configure the Lambda function to use the new IAM role.
Configure an Amazon EventBridge rule in the AWS Control Tower management account to invoke an AWS Lambda function when an AWS account is updated or enrolled in AWS Control Tower or when the landing zone is updated. Re-register each Organizations OU in the organization.
ユーザの投票
コメント(4)
B, E, and F. B: AWS Config supports delegated administrators, allowing a central account to manage configurations across the organization. By creating a Lambda function in the delegated administrator account, you can apply the customizations to the AWS Config configuration recorder in all member accounts centrally.
E: The AWSControlTowerExecution IAM role exists in each enrolled account and allows centralized operations. The IAM role in the management account needs permissions to assume the AWSControlTowerExecution role in member accounts.
F: AWS Control Tower emits events when an account is enrolled or updated, or when the landing zone is updated. An EventBridge rule can trigger the Lambda function to ensure that any new or updated accounts automatically receive the customizations. Re-registering each OU ensures that Control Tower applies its governance to all accounts and OUs consistently.
👍 3phu02982024/11/22- 正解だと思う選択肢: AEF
I think there is a misspelling in the A option as it's said just "Create a new AWS account" when it should said " Create a new AWS account as an AWS Config delegated administrator.", said that, I go for AEF.
👍 2teo21572024/12/18 - 正解だと思う選択肢: AEF
https://aws.amazon.com/solutions/guidance/customizing-aws-config-resources-in-aws-control-tower/
- Need eventbridge in CT management acct to react to CT lifecycle events
- need CT management acct lambda function to assume AWSControlTowerExecution role and customise config.
- If lambda is not in CT management acct then it will need to assume a role in CT management acct which has trust with AWSControlTowerExecution role in member accts
👍 2CHRIS127222222024/12/29
シャッフルモード