Question

A company uses an AWS Organizations organization with all features enabled to manage multiple AWS accounts. AWS Config is enabled in every account. The company requires developers to create AWS CloudFormation stacks in a new AWS account to test features for a new application the developers are building. The company needs to ensure that developers can use only approved Amazon EC2 instance types for the application. Which solution meets these requirements?

Accepted Answer

D. Create a CloudFormation Guard rule to ensure that the EC2 instance type matches a value from a list of approved instance types. Activate a Guard Hook in the new AWS account to run the Guard rule.

Answer

Create an AWS Lambda function that returns SUCCESS when the EC2 instance type property matches a value from a list of approved instance types. Activate a CloudFormation Guard Hook in the new AWS account to run the Lambda function.

Answer

Create an AWS config rule that uses the desired-instance-type rule in the new AWS account. Provide the list of approved instance types in the rule configuration. Create a remediation for the AWS config rule that uses the AWS-StopEC2Instance remediation action.

Answer

Create an SCP that includes a Deny effect for ec2:RunInstnaces when the ec2:InstanceType property does not match a value from a list of approved instance types. Attach the SCP to the root of the organization.