Exam AWS Certified DevOps Engineer - Professional DOP-C02 topic 1 question 163 discussion

B. Create an IAM role named AWSControlTowerBlueprintAccess... Required to enable CfCT to deploy customizations to accounts. The trust relationship ensures that the management account can assume the role in target accounts for customization deployments. E. Deploy the CfCT CloudFormation stack This is the core mechanism for enabling customizations across your Control Tower-managed environment. CfCT provisions and manages CloudFormation templates and optionally Service Catalog products across OUs and accounts. F. Create a CloudFormation template for each customization These templates define the infrastructure or policies you want to roll out to Control Tower accounts.

This approach ensures automation, governance, and self-service capability with the least operational overhead

CfCT provides a framework that automates the deployment of custom resources and policies across your AWS Control Tower environment. Creating and deploying individual CloudFormation templates for each customization requires significant manual effort.

"customisations that an account can request" It is an ongoing customisation, CfCt does better than AFC.

CfCT provides predefined stacksets that extend Control Tower. Offers a series of customization.

I think the correct answer is ACE. 1- Enable trusted access for CloudFormation with Organizations to allow cross-account deployments. 2- Create Service Catalog products for each CloudFormation template to provide a self-service portal. 3- Deploy the Customizations for AWS Control Tower (CfCT) stack to automate and manage customizations across your organization.

"Steps to set up Account Factory for the customization process": 1. "Create the required role...." - "The role must be named AWSControlTowerBlueprintAccess." - "The AWSControlTowerBlueprintAccess role must be set up to grant trust to" [...] - "The role named AWSControlTowerAdmin in the AWS Control Tower management account." - AWS Control Tower requires that the managed policy named AWSServiceCatalogAdminFullAccess must be attached to the AWSControlTowerBlueprintAccess role. (Required permissions policy) 2. "Create the AWS Service Catalog product..." [...] https://docs.aws.amazon.com/controltower/latest/userguide/af-customization-page.html https://docs.aws.amazon.com/controltower/latest/userguide/afc-setup-steps.html

ans: BCF

B,C,F is the only answer

BCF are correct: <an account for all centralized AWS CloudFormation > means we need to set up a role for this accoun A: Trusted access is for assuming role only D: no mention of customization E: CFCT is needed only when we need to apply to best practice

BCF are correct: <an account for all centralized AWS CloudFormation > means we need to set up a role for this accoun E: CFCT is for when we need to apply to best practice

answer BCF

https://docs.aws.amazon.com/controltower/latest/userguide/afc-setup-steps.html

https://docs.aws.amazon.com/controltower/latest/userguide/afc-setup-steps.html