SAP-C02 Practice Test 7

A central image-factory account builds hardened golden AMIs with an automated pipeline. The AMIs' EBS snapshots are encrypted with the default AWS managed key for EBS (aws/ebs), which is required by the company's baseline. Forty workload accounts in the same AWS Organization must launch instances from these AMIs. The security team has rejected making AMIs public, and it requires that the workload accounts get access to the encryption key only through a key policy that the image-factory account controls.

Attempts to share the AMIs with the workload accounts result in instances that cannot be launched there. What should the solutions architect do?