A company is divided into teams. Each team has an AWS account, and all the accounts are in an organization in AWS Organizations. Each team must retain full administrative rights to its AWS account. Each team also must be allowed to access only AWS services that the company approves for use. AWS services must gain approval through a request and approval process. How should a DevOps engineer configure the accounts to meet these requirements?
Select one answer.
Marked answer: C
Community Discussion
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
Chose C1
D. SCP that allows only approved services at the root OU: This is risky because it affects all accounts in the organization, including potentially critical shared services or management accounts. It's better to scope restrictions to a specific OU.
Chose C2
Not Option D, Using allow-list SCP, since: - Too restrictive - More difficult to maintain - Might block essential services - Could break account functionality - Requires constant updates
Chose C3
Going for C as removing the FullAWSAccess SCP from the root OU requires impacts directly in the Administrative Access and restrict necessary administrative actions required for account management and operations.
