Exam AWS Certified DevOps Engineer - Professional DOP-C02 topic 1 question 303 discussion

Agrees with CE based on the blog that CHRIS1272222 provided

C - AWS Control Tower requires the AWSControlTowerExecution role to be created in each managed account. This role allows AWS Control Tower to manage the account and enforce governance and compliance rules. When a new account is created, AWS Control Tower will need this role to carry out management tasks. E - The EnableAWSServiceAccess API operation is used to enable AWS Control Tower service access in AWS Organizations. This action ensures that AWS Control Tower can operate across the organization and manage new accounts that are created within the organization. By enabling service access for Control Tower, new accounts can be automatically enrolled in the governance and management processes of Control Tower.

Read blog https://aws.amazon.com/blogs/architecture/field-notes-enroll-existing-aws-accounts-into-aws-control-tower/ Download the python code and you will see it calls the ProvisionProduct API in method provision_sc_product

Option Details: 1. C. Create an AWSControlTowerExecution role: • AWS Control Tower requires an AWSControlTowerExecution role in new accounts. • This role allows AWS Control Tower to assume control of the account and apply the necessary guardrails, policies, and configurations. • Without this role, AWS Control Tower cannot manage the account. 2. D. Call the AWS Service Catalog ProvisionProduct API operation: • Account Factory uses AWS Service Catalog to create and enroll new accounts into AWS Control Tower. • The ProvisionProduct API operation allows programmatic provisioning of new accounts through Account Factory, ensuring enrollment into Control Tower governance.

Answer: CD (had a typo)

Answer: CE WSControlTowerExecution Role (Option C): For AWS Control Tower to manage accounts, each account must have the AWSControlTowerExecution role, which allows the AWS Control Tower administrator account to assume the role and apply required policies and controls. Creating this role in the new account enables Control Tower to perform management operations as needed. Service Catalog ProvisionProduct API (Option D): AWS Control Tower uses AWS Service Catalog products to provision and manage accounts. Calling the ProvisionProduct API operation as part of the Step Functions workflow allows the new account to be enrolled in Control Tower by provisioning it through the appropriate Service Catalog product. This step ensures that the new account is enrolled in the AWS Control Tower landing zone.