DOP-C02 Exam Dumps : AWS Certified DevOps Engineer - Professional

To meet the requirements of creating a new Organizations account structure with an appropriate SCP that supports the use of only services that are currently active in the AWS account, the company should use the following solution:

Create an SCP that allows the services that IAM Access Analyzer identifies. IAM Access Analyzer is a service that helps identify potential resource-access risks by analyzing resource-based policies in the AWS environment. IAM Access Analyzer can also generate IAM policies based on access activity in the AWS CloudTrail logs. By using IAM Access Analyzer, the company can create an SCP that grants only the permissions that are required for the application to run, and denies all other services. This way, the company can enforce the use of only approved AWS services and reduce the risk of unauthorized access12

Create an OU for the account. Move the account into the new OU. An OU is a container for accounts within an organization that enables you to group accounts that have similar business or security requirements. By creating an OU for the account, the company can apply policies and manage settings for the account as a group. The company should move the account into the new OU to make it subject to the policies attached to the OU3

Attach the new SCP to the new OU. Detach the default FullAWSAccess SCP from the new OU. An SCP is a type of policy that specifies the maximum permissions for an organization or organizational unit (OU). By attaching the new SCP to the new OU, the company can restrict the services that are available to all accounts in that OU, including the account that runs the application. The company should also detach the default FullAWSAccess SCP from the new OU, because this policy allows all actions on all AWS services and might override or conflict with the new SCP45

The other options are not correct because they do not meet the requirements or follow best practices. Creating an SCP that denies the services that IAM Access Analyzer identifies is not a good option because it might not cover all possible services that are not approved or required for the application. A deny policy is also more difficult to maintain and update than an allow policy. Creating an SCP that allows the services that IAM Access Analyzer identifies and attaching it to the organization’s root is not a good option because it might affect other accounts and OUs in the organization that have different service requirements or approvals. Creating an SCP that allows the services that IAM Access Analyzer identifies and attaching it to the management account is not a valid option because SCPs cannot be attached directly to accounts, only to OUs or roots.

1: Using AWS Identity and Access Management Access Analyzer - AWS Identity and Access Management

2: Generate a policy based on access activity - AWS Identity and Access Management

3: Organizing your accounts into OUs - AWS Organizations

4: Service control policies - AWS Organizations

5: How SCPs work - AWS Organizations

When using the awslogs log driver with ECS on EC2, the ECS agent running on the container instance uses the instance’s IAM role (container instance role or task execution role, depending on configuration) to write logs to CloudWatch Logs. The policy already grants logs:CreateLogGroup , logs:CreateLogStream , and logs:PutLogEvents , which are the required CloudWatch Logs actions. However, for the role to be usable by ECS, the role’s trust policy must allow the appropriate service principal to assume it.

In this question, the error message indicates “missing permission” during ECS task deployment. If the IAM role is not trusted by the ECS service (for example, ecs-tasks.amazonaws.com for a task execution role or the proper principal for container instances), ECS cannot assume that role and therefore cannot use the granted CloudWatch permissions, causing deployment failures.

Option A addresses this by adding a trust relationship so that Amazon ECS can assume the IAM role. Options B and C mutate the permissions but do not fix the underlying problem: the missing trust. Option D incorrectly attempts to trust CloudWatch, which does not assume roles in this context.

Thus, adding a trust policy that establishes ECS as a trusted service is the correct fix.