Exam AWS-SysOps topic 1 question 575 discussion

I can vote for B

I'll say B It's asking to implement and MANAGE the requirements. Also speaking about roles and policies and services. I'm leaning a lot towards B here.

AWS Organizations provides a centralized management approach for multiple AWS accounts. It allows you to create a hierarchy of organizational units (OUs) to group and organize accounts based on projects, teams, or other criteria. By using OUs, you can apply consistent policies and controls across multiple accounts, making it easier to manage and enforce security and compliance requirements. With AWS Organizations, you can create a separate OU for each project team's account. Within each OU, you can define service control policies (SCPs) at the account level. SCPs are used to restrict the services that can be accessed and the actions that can be performed within an account. By defining a common set of SCPs for each OU, you can ensure that the same roles and policies are enforced across all accounts in a consistent manner.

B. Use AWS Organizations to create organizational units (OUs) for each group of projects and each team. Then leverage service control policies at the account level to restrict what services can used and what actions the users, groups, and roles can perform in those accounts.

I’ll go with D

D using stackset you will work with 1 template that will define IAM users/groups/roles and it will run at all accounts and create IAM resources in a consistent manner , also you can update it anytime and all accounts will be updated in the same manner B is wrong as it will limit what services that can be used , however it won't prevent you from creating totally different users/roles/policies in each account !!

"The AWS IAM configuration must have the same roles and policies for each of the accounts." Ans is D because thats how you can deploy roles and policies and manage changes in future. Ans can not be B because there is no way to create resources using SCP and the question didn't say anything about allow/deny.

B. Use AWS Organizations to create organizational units (OUs) for each group of projects and each team. Then leverage service control policies at the account level to restrict what services can used and what actions the users, groups, and roles can perform in those accounts. Seem correct

B Source: https://aws.amazon.com/blogs/industries/defining-an-aws-multi-account-strategy-for-telecommunications-companies/

I'll go with B

Solution: B Keywords: implement and manage

B. Use AWS Organizations to create organizational units (OUs) for each group of projects and each team. Then leverage service control policies at the account level to restrict what services can used and what actions the users, groups, and roles can perform in those accounts

B。。 Stacksets only creates the policy in the multiple accounts. It does not implement the Multi-Account strategy. Only AWS Organizations can implement a Multi-Account Strategy.

Agree D is right approach: https://aws.amazon.com/blogs/aws/new-use-aws-cloudformation-stacksets-for-multiple-accounts-in-an-aws-organization/

Ans should be D - Reason ; stacksets