Multi-Account Governance — AWS Data Engineer (DEA-C01)
Policy enforcement scope separates these four governance tools
Architecture requirement: prevent production data from leaving approved regions, enforced consistently across 40 AWS accounts. Competing choices: SCPs via AWS Organizations, guardrails via Control Tower, Config rules with aggregator, permission boundaries via IAM. The deciding constraint is enforcement versus detection. SCPs deny at the API level before actions occur; Config detects drift after the fact; Control Tower extends Organizations with opinionated landing zone defaults. The scenario word 'prevent' versus 'detect' is the selection signal.
What This Pattern Tests
The exam describes a multi-account environment and tests governance controls. AWS Organizations groups accounts into OUs. SCPs on OUs set maximum permission boundaries — they deny, never grant. CloudTrail organization trails aggregate audit logs. AWS Config aggregator collects compliance data across accounts. RAM (Resource Access Manager) shares resources across accounts without duplication. The trap is using SCPs to grant permissions (they only restrict) or creating cross-account IAM users instead of cross-account roles (roles use temporary credentials).
Decision Axis
Governance scope determines the tool: organization-wide restriction = SCP, account-specific permission = IAM, cross-account sharing = RAM/roles, compliance visibility = Config aggregator.
Associated Traps
More Top Traps on This Exam
Decision Rules
Whether the scenario requires detection-only (Macie classifies PII) or access-control enforcement (Lake Formation column-level permissions) — or both — to satisfy a cross-account least-privilege constraint on PII column visibility.
Domain Coverage
Difficulty Breakdown