AWS Certified Solutions Architect – Professional — Question 717

A company has a project that is launching Amazon EC2 instances that are larger than required. The project's account cannot be part of the company's organization in AWS Organizations due to policy restrictions to keep this activity outside of corporate IT. The company wants to allow only the launch of t3.small
EC2 instances by developers in the project's account. These EC2 instances must be restricted to the us-east-2 Region.
What should a solutions architect do to meet these requirements?

Answer options

• A. Create a new developer account. Move all EC2 instances, users, and assets into us-east-2. Add the account to the company's organization in AWS Organizations. Enforce a tagging policy that denotes Region affinity.
• B. Create an SCP that denies the launch of all EC2 instances except t3.small EC2 instances in us-east-2. Attach the SCP to the project's account.
• C. Create and purchase a t3.small EC2 Reserved Instance for each developer in us-east-2. Assign each developer a specific EC2 instance with their name as the tag.
• D. Create an IAM policy than allows the launch of only t3.small EC2 instances in us-east-2. Attach the policy to the roles and groups that the developers use in the project's account.

Correct answer: D

Explanation

Option D is correct because IAM policies can be applied directly to users, groups, or roles within a standalone AWS account to enforce specific resource-level permissions, such as restricting EC2 instance types and regions. Option B is incorrect because Service Control Policies (SCPs) require AWS Organizations, which the project account cannot join due to corporate policy restrictions. Option A violates the constraint of keeping the account outside of AWS Organizations, while Option C is an operationally inefficient administrative overhead that does not actually prevent developers from launching other instance sizes.