AWS Certified DevOps Engineer – Professional (DOP-C02) — Question 309

A company use an organization in AWS Organizations to manage multiple AWS accounts. The company has enabled all features enabled for the organization. The company configured the organization as a hierarchy of OUs under the root OU. The company recently registered all its OUs and enrolled all its AWS accounts in AWS Control Tower.

The company needs to customize the AWS Control Tower managed AWS Config configuration recorder in each of the company's AWS accounts. The company needs to apply the customizations to both the existing AWS accounts and to any new AWS accounts that the company enrolls in AWS Control Tower in the future.

Which combination of steps will meet these requirements? (Choose three.)

Answer options

• A. Create a new AWS account. Create an AWS Lambda function in the new account to apply the customizations to the AWS Config configuration recorder in each AWS account in the organization.
• B. Create a new AWS account as an AWS Config delegated administrator. Create an AWS Lambda function in the delegated administrator account to apply the customizations to the AWS Config configuration recorder in the delegated administrator account.
• C. Configure an Amazon EventBridge rule in the AWS Control Tower management account to invoke an AWS Lambda function when the Organizations OU is registered or reregistered. Re-register the root Organizations OU.
• D. Configure the AWSControlTowerExecution IAM role in each AWS account in the organization to be assumable by an AWS Lambda function. Configure the Lambda function to assume the AWSControlTowerExecution IAM role.
• E. Create an IAM role in the AWS Control Tower management account that an AWS Lambda function can assume. Grant the IAM role permission to assume the AWSControlTowerExecution IAM role in any account in the organization. Configure the Lambda function to use the new IAM role.
• F. Configure an Amazon EventBridge rule in the AWS Control Tower management account to invoke an AWS Lambda function when an AWS account is updated or enrolled in AWS Control Tower or when the landing zone is updated. Re-register each Organizations OU in the organization.

Correct answer: A, E, F

Explanation

To apply customizations across all accounts securely, a separate AWS account is created to run an AWS Lambda function that targets each account in the organization (A). The Lambda function achieves the necessary cross-account access by assuming an IAM role in the management account, which is authorized to assume the pre-existing AWSControlTowerExecution role in the member accounts (E). Finally, an Amazon EventBridge rule is configured in the management account to detect AWS Control Tower lifecycle events and trigger the Lambda function automatically, with a re-registration of the OUs forced to apply the changes to existing accounts immediately (F).