A newly consolidated metro government needs AWS accounts for security, logging, shared networking, sandboxes, and each department workload. Which structure should the architect evaluate first?
Select an answer to reveal the explanation.
Short Explanation
You need separate wings—security, log archive, network, sandbox, and each department’s workload—not one giant shared apartment. Multi-account Organizations gives you that floor plan and keeps blast radius from going citywide.
Full Explanation
The newly consolidated metro government should evaluate the multi-account AWS Organizations layout with dedicated security, log archive, network, and sandbox accounts plus separate workload accounts per department. That structure isolates blast radius, enables SCPs and centralized logging, and maps chargeback boundaries to parks, police, courts, and other departments. It is the foundational landing-zone shape professional architects start from when many municipal teams share one cloud estate.
Environment accounts only, with all departments and security tooling co-located to reduce sprawl, minimizes account count while maximizing blast radius and entitlement chaos. Personal AWS Free Tier accounts under each employee’s email for production courts systems fail governance, billing, and continuity. The single account with no OUs, relying on naming prefixes alone for isolation, provides soft conventions without enforceable boundaries.
Exam caveat: multi-account with Organizations (security/log/network/sandbox/workload) is the default SAP-C02 governance answer—not 'one account to simplify.' Operational check: sketch OUs for security, infrastructure, sandboxes, and department workloads; create or invite accounts into those OUs; enable org CloudTrail to the log archive; and block member departure with SCPs as the baseline hardens.