Topic 1 Question 336

AWS Certified DevOps Engineer - Professional

Topic 1 Question 336
A company uses an organization in AWS Organizations to manage 10 AWS accounts. All features are enabled, and trusted access for AWS CloudFormation is enabled.

A DevOps engineer needs to use CloudFormation to deploy an IAM role to the Organizations management account and all member accounts in the organization.

Which solution will meet these requirements with the LEAST operational overhead?
- Create a CloudFormation StackSet that has service-managed permissions. Set the root OU as a deployment target.
- Create a CloudFormation StackSet that has service-managed permissions. Set the root OU as a deployment target. Deploy a separate CloudFormation stack in the Organizations management account.
- Create a CloudFormation StackSet that has self-managed permissions. Set the root OU as a deployment target.
- Create a CloudFormation StackSet that has self-managed permissions. Set the root OU as a deployment target. Deploy a separate CloudFormation stack in the Organizations management account.
ユーザの投票
コメント(6)
- 正解だと思う選択肢: B
  https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-orgs-associate-stackset-with-org.html#:~:text=StackSets%20doesn%27t%20deploy%20stack%20instances%20to%20the%20organization%27s%20management%20account%2C%20even%20if%20the%20management%20account%20is%20in%20your%20organization%20or%20in%20an%20OU%20in%20your%20organization
  
  Stackset cant deploy to management acct
  
  👍 4
  CHRIS127222222024/12/29
- 正解だと思う選択肢: B
  Should be B I think. A stackset with service-managed permissions does not deploy to the management account.
  
  "StackSets doesn't deploy stack instances to the organization's management account, even if the management account is in your organization or in an OU in your organization." https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-getting-started-create.html#stacksets-orgs-associate-stackset-with-org
  
  👍 3
  Impromptu2024/11/24
- 正解だと思う選択肢: A
  Using service-managed permissions simplifies the deployment process because AWS manages the permissions required for deploying the StackSet. This reduces the complexity and effort involved in setting up and managing permissions manually. By setting the root Organizational Unit (OU) as the deployment target, the StackSet will automatically deploy the IAM role to all AWS accounts under the root OU, including both existing and future accounts. This ensures comprehensive and automatic coverage. Service-managed StackSets provide a streamlined and scalable solution, requiring minimal manual intervention and oversight, thus reducing operational overhead.
  
  👍 2
  f4b18ba2024/11/22
シャッフルモード

ユーザの投票

コメント(6)