A company manages multiple AWS accounts by using AWS Organizations. Under the root OU, the company has two OUs: Research and DataOps. Because of regulatory requirements, all resources that the company deploys in the organization must reside in the ap-northeast-1 Region. Additionally, EC2 instances that the company deploys in the DataOps OU must use a predefined list of instance types. A solutions architect must implement a solution that applies these restrictions. The solution must maximize operational efficiency and must minimize ongoing maintenance. Which combination of steps will meet these requirements? (Choose two.)
Select 2 answers.
Marked answer: C
This question asks for 2 answers, but our data marks only 1. Compare with the community discussion below for the full answer.
Community Discussion
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
Chose CE1
To enforce organization-wide region restrictions and instance type controls efficiently, use SCPs. Option C uses aws:RequestedRegion in an SCP attached to the root OU, which restricts all accounts to deploy only in ap-northeast-1. Option E uses ec2:InstanceType in an SCP attached to the DataOps OU, restricting EC2 launches to approved instance types only in that OU. IAM roles or inline policies would require per-account maintenance and don’t scale — so SCPs are the correct governance solution here.
