AWS Organizations for Efficient Account Provisioning and Compliance Management
Question
You work for a large enterprise company and want to set up a secure, compliant, multi-account AWS environment.
Using that service, the end-users should provision their AWS accounts quickly.
At the same time, the central management team should be able to ensure that all accounts in AWS Organizations are aligned with industry-wide compliance policies.
Which of the following services is the most appropriate to meet the need?
Answers
Explanations
Click on the arrows to vote for the correct answer
A. B. C. D.Correct Answer: A.
Option A is CORRECT because AWS Control Tower helps to manage AWS accounts easily and enforce compliance regulations on all of the AWS accounts.
You can set up an AWS Control Tower landing zone in an existing or a new AWS Organization.
Please check https://docs.aws.amazon.com/controltower/latest/userguide/planning-your-deployment.html for details.
Please notice the differences between AWS Control Tower and AWS Organization.
AWS Control Tower is built on top of trusted and reliable AWS services, including AWS Organizations and automates the configurations with centralized governance.
Option B is incorrect because “AWS Service Catalog” helps manage a catalog of IT services and resources, but it cannot help govern AWS accounts within AWS Organizations.
Option C is incorrect because AWS Security Hub is NOT a service to manage AWS accounts.
So it cannot be preferred.
Option D is incorrect because AWS CloudWatch is used for monitoring and logging purposes and cannot be used to manage AWS accounts in AWS Organizations.
Reference:
https://docs.aws.amazon.com/controltower/latest/userguide/what-is-control-tower.htmlThe most appropriate service to meet the requirements of a secure, compliant, multi-account AWS environment for a large enterprise company, where end-users can quickly provision their AWS accounts while ensuring that all accounts in AWS Organizations comply with industry-wide policies, is AWS Control Tower.
AWS Control Tower is a service that enables the setup and management of a secure, compliant, and multi-account AWS environment. It helps central IT teams govern and manage AWS accounts across the organization while providing end-users with quick access to pre-approved services and resources they need to do their jobs.
AWS Control Tower provides several features that enable end-users to quickly provision their AWS accounts while ensuring that all accounts in AWS Organizations are aligned with industry-wide compliance policies. Some of the features include:
Automated account provisioning: AWS Control Tower automates the creation of new accounts and ensures that they comply with organizational policies and standards.
Pre-configured guardrails: AWS Control Tower provides pre-configured guardrails to ensure that all accounts comply with industry-wide compliance policies.
Centralized management: AWS Control Tower provides a centralized view of all AWS accounts, making it easy for central IT teams to manage and govern the environment.
Customizable policies: AWS Control Tower allows organizations to customize policies and controls to meet their unique compliance requirements.
In contrast, AWS Service Catalog is a service that enables organizations to create and manage catalogs of IT services that can be used by end-users to deploy resources. It is not specifically designed to meet the requirements of a secure, compliant, multi-account AWS environment.
AWS Security Hub is a security service that provides a comprehensive view of security alerts and compliance status across an organization's AWS accounts. While it can help ensure compliance, it does not provide the same level of centralized management and account provisioning capabilities as AWS Control Tower.
AWS CloudWatch is a monitoring service that collects and tracks metrics, logs, and events from AWS resources. It is not designed to meet the requirements of a secure, compliant, multi-account AWS environment.
Therefore, the correct answer is A. AWS Control Tower.
