AWS Certified CloudOps Engineer Associate SOA-C03 Practice Question

A CloudOps engineer must ensure that a new IAM role and a set of required AWS Config rules are deployed to every account in the company's AWS Organization. The resources must exist in us-east-1 and eu-west-1, and they must also be automatically provisioned when new member accounts are created. The engineer wants the simplest solution with minimal ongoing maintenance. Which approach meets these requirements?

Add the IAM role and Config rules to an AWS Resource Access Manager (RAM) resource share, share it with the organization, and enable automatic sharing with new accounts.
Create a CloudFormation StackSet with service-managed permissions, target the organization's root, enable automatic deployments to new accounts, and specify us-east-1 and eu-west-1 as deployment Regions.
Create a CloudFormation StackSet with self-managed permissions, manually create the required execution roles in each account and Region, and deploy the stack set.
Store the CloudFormation template in an S3 bucket, grant cross-account access, and configure a CodeBuild project in each account and Region to run the template when an EventBridge rule detects a new account.

Report Issue

Answer Description

CloudFormation StackSets with service-managed permissions integrate directly with AWS Organizations. By targeting the organization's root, the engineer can specify automatic deployment so that any new account is provisioned without manual intervention. The stack set can be configured to deploy concurrently to multiple Regions, meeting the us-east-1 and eu-west-1 requirement. Self-managed StackSets require the creation and upkeep of execution roles in every account and Region, increasing operational overhead. CodeBuild solutions would need custom pipelines in each account, while AWS RAM cannot share IAM roles or Config rules because those resource types are not supported. Therefore, using a service-managed CloudFormation StackSet is the most operationally efficient option.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.