SAP-C02 Practice Question 63: Declarative Policy Allowed Images
AWS Certified Solutions Architect – Professional (SAP-C02) · Test 7 · question 3 of 10
A company requires that every Amazon EC2 instance in every account of its AWS Organization launches only from AMIs that come from the company's golden-image account or from Amazon. The security team wants the requirement to remain in force in accounts created in the future and even when EC2 introduces new features or APIs, without maintaining a list of API actions to deny. The team also wants to show administrators a custom message when a launch is blocked.
Which solution meets these requirements?
Show answer and explanation
Answer:
Declarative policies *"allow you to centrally declare and enforce your desired configuration for a given AWS service at scale across an organization,"* and *"once attached, the configuration is always maintained when the service adds new features or APIs."* They are *"enforced in the service's control plane"*, unlike authorization policies such as SCPs, which regulate access to APIs. *"Accounts joining an organization will automatically inherit the declarative policy,"* and you can create customizable error messages. AWS gives *Allowed Images Settings* as its example of a declarative policy for EC2 (option D).
- A is wrong because a permissions boundary limits what an identity can do. It does not restrict which AMIs are usable, and it has to be deployed and maintained in every account. - B is wrong because an SCP controls the maximum permissions of principals at the API level, so the team has to enumerate every action that can launch an instance and update the list as EC2 adds new APIs. - C is wrong because a Config rule detects noncompliance after the instance has launched and remediates by terminating it, which is reactive and disruptive rather than a block at launch.
Reference: Declarative policies in AWS Organizations