AWS Certified DevOps Engineer - Professional DOP-C02 — Topic 1 Question 104

Question

A company is divided into teams. Each team has an AWS account, and all the accounts are in an organization in AWS Organizations. Each team must retain full administrative rights to its AWS account. Each team also must be allowed to access only AWS services that the company approves for use. AWS services must gain approval through a request and approval process. How should a DevOps engineer configure the accounts to meet these requirements?

Accepted Answer

Correct answer: D. The correct answer is D. Option D: Create an SCP that allows access to only approved AWS services. Attach the SCP to the root OU of the organization. Remove the FullAWSAccess SCP from the root OU of the organization. Service Control Policies set guardrails on what accounts in an organization can do.

AWS Certified DevOps Engineer - Professional DOP-C02 — Question 104