Enforcing Cost Controls in AWS Control Tower Development OUs

SAP-C02 By islever Editorial Last updated

Design a multi-account AWS environment. Determine a strategy to improve security.

Short answer

C Create a custom preventive control (guardrail) in AWS Control Tower to enforce restrictions on EC2/RDS instance types and services in the development OU without disrupting the landing zone's SCP management.

Question

A company orchestrates a multi-account structure on AWS by using AWS Control Tower. The company is using AWS Organizations, AWS Config, and AWS Trusted Advisor. The company has a specific OU for development accounts that developers use to experiment on AWS. The company has hundreds of developers, and each developer has an individual development account.
The company wants to optimize costs in these development accounts. Amazon EC2 instances and Amazon RDS instances in these accounts must be burstable. The company wants to disallow the use of other services that are not relevant.
What should a solutions architect recommend to meet these requirements?
  1. Create a custom SCP in AWS Organizations to allow the deployment of only burstable instances and to disallow services that are not relevant. Apply the SCP to the development OU.
  2. Create a custom detective control (guardrail) in AWS Control Tower. Configure the control (guardrail) to allow the deployment of only burstable instances and to disallow services that are not relevant. Apply the control (guardrail) to the development OU.
  3. Create a custom preventive control (guardrail) in AWS Control Tower. Configure the control (guardrail) to allow the deployment of only burstable instances and to disallow services that are not relevant. Apply the control (guardrail) to the development OU. Correct Answer
  4. Create an AWS Config rule in the AWS Control Tower account. Configure the AWS Config rule to allow the deployment of only burstable instances and to disallow services that are not relevant. Deploy the AWS Config rule to the development OU by using AWS CloudFormation StackSets.

Key Takeaways

The main trap is confusing direct SCP manipulation (which causes drift in Control Tower) with using Control Tower's native Custom Guardrails feature.

This question tests knowledge of AWS Control Tower guardrails versus direct AWS Organizations SCP management. The correct solution is to use a custom preventive guardrail to restrict instance types and services in a development OU.

Common mistake: Many candidates choose Option A (Custom SCP) because it is the underlying mechanism of control. However, directly editing SCPs in AWS Organizations for a Control Tower-managed OU is explicitly discouraged as it can break the landing zone's control state.

Expert Analysis

The scenario requires enforcing specific constraints (burstable instances only, disallowing irrelevant services) on a set of development accounts managed within an AWS Control Tower landing zone. The key to this question lies in understanding the relationship between AWS Organizations and AWS Control Tower.

AWS Control Tower is built on top of AWS Organizations. It manages Service Control Policies (SCPs) to enforce preventive controls (guardrails). While developers might assume they can manage SCPs directly via the AWS Organizations console, AWS documentation explicitly warns against this practice for OUs registered with Control Tower. Directly modifying or creating custom SCPs via AWS Organizations on a Control Tower-managed OU can cause the policy state to drift from what Control Tower expects, potentially leading to an "unknown" control state that requires manual repair or re-registration of the OU.

Option A suggests creating a custom SCP in AWS Organizations. This is incorrect because it violates the governance model of Control Tower; you should not manually edit SCPs on CT-managed OUs.

Option B suggests a detective control. Detective controls only report violations after they occur; they do not prevent them. The requirement is to "disallow" usage, which implies prevention.

Option C suggests creating a custom preventive control (guardrail) in AWS Control Tower. This is the correct approach. AWS Control Tower allows users to create custom guardrails that automatically generate and apply the necessary SCPs behind the scenes. By using the Control Tower interface to create a custom preventive guardrail, you ensure that the enforcement mechanism is integrated correctly with the landing zone's governance framework without causing state drift. This method safely restricts API actions (like ec2:RunInstances) to specific instance types (t, m burstable-capable, etc.) while denying other services.

Option D involves AWS Config rules. While Config can detect non-compliance, it does not proactively prevent resource creation in the same direct way as an SCP. Furthermore, managing Config rules via CloudFormation StackSets across multiple accounts is more complex and less native to the Control Tower governance model than using Guardrails.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When dealing with AWS Control Tower questions, always prioritize native Control Tower features (Guardrails, Landing Zone settings) over raw AWS Organizations or IAM configurations unless specifically asked about low-level overrides. Remember that Control Tower manages SCPs; manual intervention via the Organizations console is usually a distractor representing a common operational mistake.

Frequently Asked Questions

Can I manually create SCPs for an OU managed by AWS Control Tower?

No. Manually creating or updating SCPs via AWS Organizations for an OU registered with Control Tower can cause the controls to enter an unknown state, requiring manual repair or re-registration of the OU.

What is the difference between a preventive and detective guardrail in Control Tower?

Preventive guardrails stop actions from occurring if they violate defined criteria (e.g., blocking non-burstable instances). Detective guardrails only monitor and report violations after resources are created.

How do Custom Guardrails work under the hood?

Custom Guardrails in AWS Control Tower automatically create and attach the necessary Service Control Policies (SCPs) to the target OU or account, ensuring compliance with the landing zone's governance model.

More SAP-C02 FAQ →

Community Votes

A
59%
C
41%

59% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 43 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 30 of 43

  1. edder 👍 13 Answered C
    I don't think it's appropriate to make SCP changes from Organization to an OU managed by Control Tower, as it will cause drift. The recommended method is to set it as Preventive. https://docs.aws.amazon.com/controltower/latest/userguide/controls.html https://docs.aws.amazon.com/controltower/latest/userguide/governance-drift.html
  2. Josh1217 👍 8 Answered C
    Cannot be A. SCP will create drift and SCPs are used for denying any specific action, not allow as stated in option A.
  3. BrijMohan08 👍 5 Answered A
    Applying the custom SCP to the development OU will enforce the restrictions on all the accounts within that OU, effectively limiting the developers to using only the allowed resources and services. AWS Control Tower guardrails (options B and C) are not the ideal solution in this case because they are primarily used for governance and compliance purposes, rather than granular service-level restrictions.
  4. career360guru 👍 4 Answered C
    C is the best option. A is possible but given that customer is using Control Tower it option A will cause a drift in landing zone.
  5. vibzr2023 👍 4
    Answer C: AWS Control tower already using and preventive control (guardrail) is the key
Show 25 more comments
  1. shaaam80 👍 4 Answered A
    A is correct! Best practice for OU's is to configure restrictions at the SCP.
  2. nublit 👍 4
    The SCP is only to deny actions. A say "allow to..."
  3. yog927 👍 3 Answered A
    Anwer is A. "Custom SCP" Drift is caused if you edit the existing SCP. Don't use AWS Organizations to update service control policies (SCPs) attached to an OU that is registered with AWS Control Tower. Doing so could result in the controls entering an unknown state, which will require you to repair your landing zone or re-register your OU in AWS Control Tower. Instead, you can create new SCPs and attach those to the OUs rather than editing the SCPs that AWS Control Tower has created. https://docs.aws.amazon.com/controltower/latest/userguide/orgs-guidance.html
  4. ele 👍 3 Answered A
    AWS Control Tower offers an abstracted, automated, and prescriptive experience on top of AWS Organizations. It automatically sets up AWS Organizations as the underlying AWS service to organize accounts and implement preventive controls using service control policies (SCPs). Using AWS Organizations, you can further create and attach custom SCPs that centrally control the use of AWS services and resources across multiple AWS accounts. https://aws.amazon.com/controltower/faqs/
  5. TonytheTiger 👍 3 Answered A
    Option A - The preventive controls are implemented using Service Control Policies (SCPs), which are part of AWS Organizations Read " Implementation of control behavior" section https://docs.aws.amazon.com/controltower/latest/userguide/controls.html
  6. kejam 👍 3 Answered C
    Answer C: I know its usually safe to choose the SCP answer, but according to the docs that would create drift with Control Tower and need to be remediated. https://docs.aws.amazon.com/controltower/latest/userguide/drift.html#scp-invariance-scans
  7. BelloMio 👍 3 Answered A
    All the people that have selected C have never used guardrails in control tower. There is no such guardrail to do this, plus you do not have the option to create custom guardrails.
  8. ayadmawla 👍 3
    A = C custom preventive control (guardrail) = SCP custom detective control (guardrail) = AWS Config https://docs.aws.amazon.com/controltower/latest/userguide/controls.html
  9. Russs99 👍 3 Answered A
    Answer is A, you cannot use control tower to control services that can be ran, it only a guard rail
  10. Deztroyer88 👍 3 Answered A
    No such thing as custom preventive guardrail. You have to set SCP and correct answer is A
  11. adelynllllllllll 👍 3
    Answer : C because A said the SCP will apply to " AWS Organizations" not the OU.
  12. Dgix 👍 3 Answered A
    Custom preventive guardrails in CT can't do this. The correct answer is A.
  13. Totoroha 👍 3
    Answer is A. Best practice
  14. salazar35 👍 3 Answered A
    I choose A
  15. AgboolaKun 👍 2 Answered A
    A is the correct answer. About C - While AWS Control Tower does support preventive controls, SCPs are actually the mechanism used by Control Tower for preventive controls. Creating a custom preventive control directly in Control Tower is not the proper approach. In this documentation - https://docs.aws.amazon.com/controltower/latest/controlreference/controls.html that a few respondents referenced, there is a disclaimer there that says "We are transitioning our terminology to align better with industry usage and with other AWS services. During this time, you may see the previous term, guardrail, as well as the new term, control, in our documentation, console, blogs, and videos. These terms are synonymous for our purposes." Please take note.
  16. bobbybasher919 👍 2 Answered A
    Seems like a bunch of people here have never used SCPs or CT. It's also a badly worded question, scp don't allow as such but allow can also mean not denying so you effectively allow certain instances types only for example, an SCP to allow burstable could be { "Effect": "Deny", "Action": "ec2:RunInstances", "Resource": "", "Condition": { "StringNotLike": { "ec2:InstanceType": [ "t3.", "t4g.*" ] } } } it doesn't mean you are allowing users to implicitly deploy without permissions. C is not a feature, it doesnt exist. you manage it with SCPs.
  17. ayadmawla 👍 2
    Q: How does AWS Control Tower interoperate with AWS Organizations? AWS Control Tower offers an abstracted, automated, and prescriptive experience on top of AWS Organizations. It automatically sets up AWS Organizations as the underlying AWS service to organize accounts and implement preventive controls using service control policies (SCPs). Using AWS Organizations, you can further create and attach custom SCPs that centrally control the use of AWS services and resources across multiple AWS accounts. https://aws.amazon.com/controltower/faqs/
  18. that1guy 👍 2 Answered A
    As long as you do not update the policies that Control Tower manages, this is fine: > Don't use AWS Organizations to update service control policies (SCPs) attached to an OU that is registered with AWS Control Tower. Doing so could result in the controls entering an unknown state, which will require you to reset your landing zone or re-register your OU in AWS Control Tower. Instead, you can create new SCPs and attach those to the OUs rather than editing the SCPs that AWS Control Tower has created.
  19. Denizka 👍 2 Answered C
    A (Custom SCP in AWS Organizations) → SCPs can block services, but cannot filter by instance type directly (you’d need conditions, but EC2 instance-type restrictions are tricky and not as native as Control Tower preventive guardrails)
  20. fabriciollf 👍 2 Answered C
    Preventive guardrails deployed by AWS Control Tower are implemented via service control policies (SCPs). https://docs.aws.amazon.com/wellarchitected/latest/management-and-governance-guide/controls.html
  21. Dandelion2025 👍 2 Answered A
    AWS Control Tower does not support creating custom preventive controls. You must use custom SCPs in AWS Organizations for custom preventive requirements.
  22. ahrentom 👍 2 Answered C
    I go with C, because of https://docs.aws.amazon.com/controltower/latest/userguide/governance-drift.html#drift-scp-attached-ou
  23. Halliphax 👍 2 Answered C
    C. Cannot be A as SCPs are for deny policies only but the answer specifies creating an SCP to allow and deny.
  24. kivi_bg 👍 2 Answered A
    There is no such option in CT crate custom guardrail.
  25. 3967974 👍 2 Answered C
    SCP can not be used to allow.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Cost-Effective Image Processing with SQS and S3 Lifecycle Policies

S-grade

Modernize centralized firewall appliances with a Gateway Load Balancer and Auto Scaling

S-grade

Use Lambda over a CloudWatch Logs stream to count unique users per client

S-grade

Serve global game assets with Route 53 latency records and health checks

S-grade

Practice All SAP-C02 Questions

Access 85 questions with complete answers and detailed explanations.

View Full SAP-C02 Practice Test →

← Back to SAP-C02 Study Guide