AWS Control Tower Proactive Controls for CloudFormation

SAA-C03 By islever Editorial Last updated

Design secure workloads and applications.

Short answer

A Use AWS Control Tower proactive controls to block deployment of EC2 instances with public IP addresses and inline policies with elevated access or “*”.

Question

A company needs a solution to prevent AWS CloudFormation stacks from deploying AWS Identity and Access Management (IAM) resources that include an inline policy or “*” in the statement. The solution must also prohibit deployment of Amazon EC2 instances with public IP addresses. The company has AWS Control Tower enabled in its organization in AWS Organizations. Which solution will meet these requirements?
  1. Use AWS Control Tower proactive controls to block deployment of EC2 instances with public IP addresses and inline policies with elevated access or “*”. Correct Answer
  2. Use AWS Control Tower detective controls to block deployment of EC2 instances with public IP addresses and inline policies with elevated access or “*”.
  3. Use AWS Config to create rules for EC2 and IAM compliance. Configure the rules to run an AWS Systems Manager Session Manager automation to delete a resource when it is not compliant.
  4. Use a service control policy (SCP) to block actions for the EC2 instances and IAM resources if the actions lead to noncompliance.

Key Takeaways

The core trap is confusing preventive mechanisms; only Control Tower Proactive Controls can block CloudFormation stack deployments based on specific resource configurations, whereas SCPs (Option D) act at the API level and lack this granular template-level enforcement capability.

This question tests the use of AWS Control Tower proactive controls to enforce compliance policies before AWS CloudFormation resources are deployed, specifically blocking IAM inline policies with wildcard permissions and EC2 instances with public IPs.

Common mistake: Many candidates choose Option D (SCPs) because they view it as a 'preventive' control, but SCPs cannot inspect the internal structure of a CloudFormation template to block specific IAM policy statements or EC2 IP settings during deployment.

Expert Analysis

Why the Answer Is Correct

AWS Control Tower Proactive Controls are designed to prevent the creation of non-compliant resources by validating configurations before they are provisioned via AWS CloudFormation. The scenario requires blocking two specific conditions: IAM resources with inline policies containing '*' and EC2 instances with public IP addresses. AWS Control Tower provides built-in proactive rules for these exact scenarios (e.g., ct-iam-pr-1 for IAM and ct-ec2-pr-9 for EC2). When activated, these controls hook into CloudFormation to reject stacks that violate these policies, making Option A the correct solution.

Why the Other Options Are Wrong

Option B is incorrect because Detective Controls only identify and log non-compliant resources after they exist; they do not prevent deployment. Option C uses AWS Config with Systems Manager automation, which is a reactive remediation approach rather than a preventive one, meaning the non-compliant resources would be created first and then deleted. Option D suggests using Service Control Policies (SCPs); while SCPs are powerful preventive controls, they operate at the API call level in Organizations and generally cannot inspect the detailed JSON structure of CloudFormation templates to block specific inline policy definitions or instance metadata like public IPs in the same granular way Proactive Controls do.

Community Comment Notes

The community heavily favored Option A, with several users citing official AWS documentation links that confirm the existence of specific proactive controls for IAM and EC2 scenarios. One user noted that "Proactive controls check whether resources are compliant... before the resources are provisioned," highlighting the timing difference from detective controls. Another user pointed out that SCPs are used to manage permissions broadly, whereas Proactive Controls offer the specific granular prevention needed here. Some dissenting votes for D were based on the general concept of 'prevention,' but failed to account for the CloudFormation-specific context of the question.

Official Reference

https://docs.aws.amazon.com/controltower/latest/userguide/proactive-controls.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

Always look for keywords like 'CloudFormation' and 'prevent deployment' when evaluating Control Tower options. If the requirement involves stopping a stack from creating specific resource attributes, Proactive Controls are the primary tool, not SCPs or Config.

Frequently Asked Questions

Why can't SCPs block CloudFormation stacks with specific IAM policies?

SCPs evaluate API calls at the Organization level and typically cannot parse the complex JSON structures within CloudFormation templates to block specific inline policy definitions.

What is the difference between Proactive and Detective controls?

Proactive controls prevent resource creation if they violate rules, while Detective controls only identify and report non-compliant resources after they have been successfully created.

More SAA-C03 FAQ →

Community Votes

A
71%
D
29%

71% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 11 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 11

  1. [Removed] 👍 9 Answered A
    proactive controls pls see links for both * in inline policy: https://docs.aws.amazon.com/controltower/latest/userguide/iam-rules.html#ct-iam-pr-1-description and for ec2 public IP: https://docs.aws.amazon.com/controltower/latest/userguide/ec2-rules.html#ct-ec2-pr-9-description
  2. jaswantn 👍 8 Answered D
    Option D... This is preventive control of Control Tower where we use SCP to disallow actions that lead to policy violation.
  3. osmk 👍 6 Answered A
    Proactive controls are implemented using AWS CloudFormation hooks within AWS Control Tower. They operate before resources are deployed to determine compliance with activated controls. SCPs are part of AWS Organizations and are used to manage permissions. vs Define specific purposes for implementing controls.https://docs.aws.amazon.com/controltower/latest/userguide/proactive-controls.html
  4. MatAlves 👍 3 Answered A
    Prevent AWS CloudFormation from deploying IAM resources and EC2 instances based on specific use cases = Control Tower Proactive controls. "Proactive controls are security controls that are designed to prevent the creation of noncompliant resources. For example (...), through AWS CloudFormation, the proactive control can prevent the creation of update of any S3 bucket that has public access enabled." https://docs.aws.amazon.com/prescriptive-guidance/latest/aws-security-controls/proactive-controls.html
  5. FlyingHawk 👍 2 Answered A
    Proactive controls check whether resources are compliant with your company policies and objectives, before the resources are provisioned in your accounts. If the resources are out of compliance, they are not provisioned. Proactive controls monitor resources that would be deployed in your accounts by means of AWS CloudFormation templates. For those who are familiar with AWS: In AWS Control Tower preventive controls are implemented with Service Control Policies (SCPs). Detective controls are implemented with AWS Config rules. Proactive controls are implemented with AWS CloudFormation hooks.
Show 6 more comments
  1. NayeraB 👍 2 Answered A
    A would provide a proactive solution, also I'm not sure if SCP are made for granular details like creation of EC2 instances with public IP addresses or IAM resources with certain inline policies.
  2. BBR01 👍 1 Answered D
    It is D. You want to prevent the events from happening. Proactive controls check whether resources are compliant with your company policies and objectives, before the resources are provisioned in your accounts. Detective controls detect specific events when they occur and log the action in CloudTrail. Preventive controls prevent actions from occurring. Preventive controls are implemented with SCPs. Detective controls are implemented with AWS Config rules. Proactive controls are implemented with AWS CloudFormation hooks. https://docs.aws.amazon.com/controltower/latest/userguide/how-control-tower-works.html#how-controls-work
  3. LeonSauveterre 👍 1 Answered A
    A - Proactive controls are a feature of AWS Control Tower that prevent noncompliant resources from being deployed by validating configurations before deployment. B - Detective controls can't block deployment. C - If you must monitor to get it right, then something's already wrong before you notice that. D - SCPs can indeed block specific API calls for creating IAM resources with "*" or EC2 instances with public IPs, but can't make the most of AWS CloudFormation stacks. Plus, SCPs apply at the account level and might inadvertently restrict legitimate use cases. Not ideal enough is what I'm saying.
  4. Sergiuss95 👍 1 Answered D
    Is D, the best way to prevent this actions, is deploying SCPs
  5. 88f8032 👍 2 Answered A
    this is A
  6. Andy_09 👍 2
    Option D

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide