Topic 1 Question 294
A company uses an organization in AWS Organizations to manage the company's AWS accounts. The company uses AWS CloudFormation to deploy all infrastructure. A finance team wants to build a chargeback model. The finance team asked each business unit to tag resources by using a predefined list of project values.
When the finance team used the AWS Cost and Usage Report in AWS Cost Explorer and filtered based on project, the team noticed noncompliant project values. The company wants to enforce the use of project tags for new resources.
Which solution will meet these requirements with the LEAST effort?
Create a tag policy that contains the allowed project tag values in the organization's management account. Create an SCP that denies the cloudformation:CreateStack API operation unless a project tag is added. Attach the SCP to each OU.
Create a tag policy that contains the allowed project tag values in each OU. Create an SCP that denies the cloudformation:CreateStack API operation unless a project tag is added. Attach the SCP to each OU.
Create a tag policy that contains the allowed project tag values in the AWS management account. Create an IAM policy that denies the cloudformation:CreateStack API operation unless a project tag is added. Assign the policy to each user.
Use AWS Service Catalog to manage the CloudFormation stacks as products. Use a TagOptions library to control project tag values. Share the portfolio with all OUs that are in the organization.
ユーザの投票
コメント(13)
- 正解だと思う選択肢: A
A is correct BUT I did NOT like the last line in option A. It says "Attach the SCP to each OU". Why should you attach SCP to each OU. Can't you just attach to RootOU so it gets inherited to child OUs
👍 4bhanus2023/06/24 - 正解だと思う選択肢: A
A) Is correct in the master account of all organization use SCP is less overhead than B B ) is more overhead than A because in each OU create SCP C ) IAM in all account is more overhead D) is valid but not restrict other options o create with CLI or console the rest service without tags
Then A is correct
👍 3SkyZeroZx2023/06/23 - 正解だと思う選択肢: A
A) in management account for tag policy and SCP , Sounds Good B) for each account ? more overhead C ) IAM for account in cloudformation ? is incorrect in this case D) AWS Service Catalog ? why ? incorrect
👍 2SkyZeroZx2023/06/28
シャッフルモード