A company has multiple lines of business (LOBs) that roll up to the parent company. The company has asked its solutions architect to develop a solution with the following requirements: • Produce a single AWS invoice for all of the AWS accounts used by its LOBs. • The costs for each LOB account should be broken out on the invoice. • Provide the ability to restrict services and features in the LOB accounts, as defined by the company's governance policy. • Each LOB account should be delegated full administrator permissions, regardless of the governance policy. Which combination of steps should the solutions architect take to meet these requirements? (Choose two.)
- AUse AWS Organizations to create an organization in the parent account for each LOB. Then invite each LOB account to the appropriate organization.
- BUse AWS Organizations to create a single organization in the parent account. Then, invite each LOB's AWS account to join the organization. (correct answer)
- CImplement service quotas to define the services and features that are permitted and apply the quotas to each LOB. as appropriate.
- DCreate an SCP that allows only approved services and features, then apply the policy to the LOB accounts. (correct answer)
- EEnable consolidated billing in the parent account's billing console and link the LOB accounts.
Reveal answer & explanationHide answer
The correct answer is B, D. Option B: Use AWS Organizations to create a single organization in the parent account. Then, invite each LOB's AWS account to join the organization. Option D: Create an SCP that allows only approved services and features, then apply the policy to the LOB accounts.
Explanation
AWS Organizations centrally governs and secures multiple AWS accounts. Service Control Policies set guardrails on what accounts in an organization can do.