SAP-C02 Practice Question 51: Baseline Deployment New Accounts
AWS Certified Solutions Architect – Professional (SAP-C02) · Test 6 · question 1 of 10
A platform team must place a standard security baseline (an incident response IAM role, a log forwarding configuration, and a set of AWS Config rules) into all 140 accounts of its organization, in three Regions. New accounts are vended weekly and must receive the baseline without anyone remembering to act.
Two organizational constraints apply. Company policy forbids using the organization's management account for day-to-day operations, so the platform team works from its own member account. Application teams must not be able to create the baseline resources themselves, because the baseline's IAM role has to be identical everywhere.
What should the solutions architect implement?
Show answer and explanation
Answer:
Service-managed permissions is the StackSets model built for AWS Organizations. With it you deploy stack instances to accounts managed by Organizations without creating the cross-account IAM roles yourself, StackSets creates them on your behalf, and, critically for this requirement, "you can also turn on automatic deployments to accounts that you add to your organization in the future". Targeting the organization root covers all 140 accounts and everything vended later, and adding an account to a target OU triggers the create operation automatically. The delegated administrator concept is what keeps this out of the management account: a member account registered as a StackSets delegated administrator can be the administrator account for service-managed StackSets, so the platform team administers the baseline from its own account. Because the resources are created by StackSets rather than by application teams, the IAM role is identical everywhere.
Option B is the self-managed model, which exists for deploying outside an organization. It obliges the team to create the execution role in every target account and to bolt on a script that races the account vending process, the manual coupling that service-managed permissions removes.
Option C makes the baseline optional in practice. Application teams can apply a modified module, apply it late, or not at all, and the guarantee that the incident response role is identical everywhere is lost.
Option D is a bespoke re-implementation of StackSets. It handles account creation but not drift, updates across 140 accounts and three Regions, failure tolerance, or accounts that move between organizational units, all of which StackSets handles as first-class operations.
Reference: StackSets concepts