AWS Certified DevOps Engineer - Professional DOP-C02

By Amazon · Question Mode

QuestionQ13

Security and Compliance

A company uses AWS Organizations to centrally administer its AWS accounts. It enabled AWS Config in every member account by using AWS CloudFormation StackSets. The company configured trusted access in Organizations for AWS Config and designated a member account as the delegated administrator account for AWS Config.

A DevOps engineer must implement a new security policy. The policy must require all existing and future AWS member accounts to use a shared baseline of AWS Config rules, including remediation actions, that is managed from a central account. Non-administrator users with access to member accounts must be unable to modify this shared baseline of AWS Config rules deployed in each member account.

Which solution meets these requirements?

Explanation

An AWS Config organization conformance pack is a centrally managed collection of AWS Config rules and remediation actions that can be deployed across an AWS Organization, including to future member accounts. A management account or AWS Config delegated administrator can deploy it. AWS Config creates the rules and remediation configurations in member accounts through its service-linked role, so member-account users do not need—and need not receive—the permissions that manage the centrally deployed baseline.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!