Which combination of steps will meet these requirements?
(Choose three.)
Use AWS CloudFormation StackSets to deploy AWS Config rules on production accounts.
Create a new AWS Control Tower landing zone in an existing developer account. Create OUs for accounts. Add production and development accounts to production and development OUs, respectively.
Create a new AWS Control Tower landing zone in the company’s management account. Add production and development accounts to production and development OUs. respectively.
Invite existing accounts to join the organization in AWS Organizations. Create SCPs to ensure compliance.
Create a guardrail from the management account to detect EBS encryption.
Create a guardrail for the production OU to detect EBS encryption.
Explanations:
AWS CloudFormation StackSets can be used to deploy resources across multiple accounts, but it doesn’t directly help with enforcing EBS encryption. AWS Config rules would be more appropriate for enforcing EBS encryption, and they are better managed through AWS Control Tower.
AWS Control Tower is used to set up and manage landing zones, but creating an AWS Control Tower landing zone in a developer account is not ideal for enforcing production account policies. Control Tower should be set up in the management account.
Setting up AWS Control Tower in the management account is the correct approach to manage and enforce policies across multiple accounts. Creating OUs (Organizational Units) and adding production and development accounts helps enforce the desired policies using built-in guardrails.
Inviting existing accounts to AWS Organizations and creating Service Control Policies (SCPs) is a valid method to enforce compliance across AWS accounts, ensuring that only the production accounts have policies that require EBS encryption.
Guardrails are best created within AWS Control Tower, not manually through the management account alone. Additionally, AWS Control Tower provides built-in guardrails to monitor and enforce best practices like EBS encryption across accounts.
AWS Control Tower provides the ability to create guardrails to enforce specific requirements such as EBS encryption at rest. Applying the guardrail to the production OU ensures that encryption policies are enforced for production accounts.
I assess that the answer is:
Create a new AWS Control Tower landing zone in the company’s management account. Add production and development accounts to production and development OUs. respectively.