4.2 - Compliance and governance (Config, Organizations, SCPs)
AWS SysOps Administrator objective 4.2 covers compliance and multi-account governance. AWS Organizations groups accounts into organizational units, and Service Control Policies cap the maximum permissions in member accounts - they restrict, never grant, and do not affect the management account. AWS Config rules evaluate resources, conformance packs bundle rules and remediation, and an aggregator gives one compliance view across accounts and Regions. A centralized organization CloudTrail trail and a Config aggregator support audit. AWS Control Tower sets up a landing zone with guardrails and Account Factory for governed account vending. Cost allocation tags and tag policies keep tagging consistent, and consolidated billing shares volume discounts and Reserved Instance or Savings Plans coverage. Expect scenario questions about blocking an action org-wide, proving compliance across accounts, or standing up a governed landing zone, and ask which governance service applies.
Cap permissions across accounts (never grant) = Service Control Policy, and it never affects the management account. One compliance view across accounts = AWS Config aggregator. Governed landing zone = Control Tower.
Practice questions
1. Instances running the CloudWatch agent fail to publish custom metrics with an AccessDenied error. Which IAM permission is most likely missing from the instance role?
- cloudwatch:PutMetricData (correct answer)
- cloudwatch:DescribeAlarmsForMetric on the target namespace resource
- logs:CreateLogGroup for the metric stream destination
- ec2:MonitorInstances on the affected running instances
Publishing metrics requires cloudwatch:PutMetricData on the instance role; without it the agent gets AccessDenied. DescribeAlarmsForMetric is read-only, and ec2:MonitorInstances toggles detailed monitoring, not metric publishing.
2. Which two IAM actions must the CloudWatch agent's role allow to deliver EC2 logs? (Choose TWO.)
- logs:PutLogEvents to write events into the stream (correct answer)
- logs:DeleteLogGroup so the agent can rotate old groups itself
- kms:ScheduleKeyDeletion to manage the encryption key lifecycle
- logs:CreateLogStream to open the stream before writing (correct answer)
The agent needs logs:CreateLogStream to open a stream and logs:PutLogEvents to write into it (plus optionally CreateLogGroup). DeleteLogGroup and ScheduleKeyDeletion are destructive and have no place in a log-shipping role.
3. Auditors warn that a publicly shared dashboard could leak sensitive metrics. What is the safest fix?
- Leave the dashboard public but simply rename all of the widgets
- Require sign-in or a password on the shared dashboard (correct answer)
- Delete every alarm that the dashboard displays
- Move the dashboard into a brand new AWS Region
Dashboard sharing supports requiring sign-in (via IAM Identity Center) or a password, restricting who can view the metrics. Renaming widgets still exposes data, deleting alarms removes monitoring, and changing Region does not restrict access.
4. A remediation Lambda must retag and stop a non-compliant instance. Which permissions belong in its execution role? (Choose TWO.)
- ec2:CreateTags on the target instances (correct answer)
- iam:CreateUser to provision a new operator
- ec2:StopInstances on the target instances (correct answer)
- s3:DeleteBucket to clean up related storage
Retagging needs ec2:CreateTags and stopping needs ec2:StopInstances, scoped to the targets under least privilege. iam:CreateUser and s3:DeleteBucket are unrelated and would over-grant the role.
5. A config rule reports a resource as NON_COMPLIANT. What does that compliance status specifically mean?
- The resource was permanently deleted from the account
- The rule failed to run at all
- The resource violates the rule's condition (correct answer)
- The recorder is turned off for it
NON_COMPLIANT means the resource was evaluated and did not meet the rule's condition. It is distinct from a deletion, from an evaluation error, and from the recorder being off (which yields no evaluation).
6. Governance requires every resource to carry a CostCenter tag. Which AWS Config managed rule enforces the presence of specified tags?
- ec2-instance-managed-by-ssm
- cloudtrail-enabled
- iam-user-mfa-enabled
- required-tags (correct answer)
The required-tags managed rule checks that resources have the tag keys (and optional values) you specify. The other rules address SSM management, CloudTrail, and MFA, not tagging.