AWS Certified SysOps Administrator – AssociateDeployment, Provisioning, and AutomationHard
A security team needs to enforce strict network configurations for all newly provisioned Amazon EC2 instances. They want to ensure that instances are launched only with approved security groups and network ACLs, and that no instance can be launched into a public subnet without explicit approval. This enforcement must happen automatically at the time of resource provisioning. Which AWS service is most effective for implementing these preventative controls?
- AAWS Network Firewall
- BAWS Security Hub
- CAWS Organizations Service Control Policies (SCPs)
- DAWS Config
Show answer & explanationAnswer & explanation
Correct answer: C. AWS Organizations Service Control Policies (SCPs)
AWS Organizations Service Control Policies (SCPs) allow you to centrally control permissions for all accounts in your organization. They can be used to prevent actions, such as launching instances with unapproved network configurations or into public subnets, by denying specific API calls. This provides preventative control at the account level.
Why the other options are wrong
- A. AWS Network Firewall filters network traffic, but it doesn't control the provisioning of EC2 instances or their initial network configurations.
- B. Security Hub aggregates security findings and performs checks, but it's a detective control, not preventative for resource provisioning.
- D. AWS Config assesses, audits, and evaluates configurations, providing detective controls and remediation, but it doesn't prevent non-compliant resources from being provisioned.
AWS Organizations Service Control Policies (SCPs)
Policy type that allows you to manage permissions in your organization. SCPs offer central control over the maximum available permissions for all accounts in an organization.
- Apply to all IAM users and roles in affected accounts.
- Are preventative controls (deny actions before they happen).
- Cannot grant permissions; they only filter existing permissions.
Memory trick: SCPs secure the organization, strictly preventing bad behavior.