AWS Certified DevOps Engineer - Professional DOP-C02 — Topic 1 Question 160

Question

A company has an AWS Control Tower landing zone. The company's DevOps team creates a workload OU. A development OU and a production OU are nested under the workload OU. The company grants users full access to the company's AWS accounts to deploy applications. The DevOps team needs to allow only a specific management IAM role to manage the IAM roles and policies of any AWS accounts in only the production OU. Which combination of steps will meet these requirements? (Choose two.)

Accepted Answer

Correct answer: B, E. The correct answer is B, E. Option B: Ensure that the FullAWSAccess SCP is applied at the organization root. Option E: Create an SCP that denies IAM related actions with a condition to exclude the management IAM role. Attach the SCP to the production OU. An IAM role grants temporary, least-privilege permissions to AWS resources without long-term credentials. AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies. Service Control Policies set guardrails on what accounts in an organization can do.

AWS Certified DevOps Engineer - Professional DOP-C02 — Question 160