Exam AWS Certified DevOps Engineer - Professional DOP-C02 topic 1 question 167 discussion

A is correct: We need account creation events and this option provides us with exactly that B: < Create an EventBridge rule in the services account that directly listens to CloudTrail events>: This does not make sense. We should apply rule to eventbus to send event C and D: Both options send all events, not just account creation events

A is right. "Create an Amazon EventBridge rule in the automation account to send account creation events to the default event bus in the services accounts": propagation of provision events to the service accounts. "Update the default event bus in the services accounts to allow events from the automation account.": correct B. "Create a custom Amazon EventBridge event bus in the services accounts. Update the custom event bus to allow events from the automation account.": correct however "Create an EventBridge rule in the services account that directly listens to CloudTrail events from the automation account.": Why do you create a rule in the services account listening the events from automation account, in opposite, the rule should be created in the automation account to push the events to the bus in the services account.

I'm voting B A - there could be more than 5 accounts: https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-rules-best-practices.html - "While you can specify up to five targets for a given rule" It's perfectly viable to create rule in one account to receive events from second account.

The steps to configure EventBridge to send events to or receive events from an event bus in a different account include the following: On the receiver account, edit the permissions on an event bus to allow specified AWS accounts, an organization, or all AWS accounts to send events to the receiver account. On the sender account, set up one or more rules that have the receiver account's event bus as the target. If the sender account inherits permissions to send events from an AWS Organization, the sender account also must have an IAM role with policies that enable it to send events to the receiver account. If you use the AWS Management Console to create the rule that targets the event bus in the receiver account, the role is created automatically. On the receiver account, set up one or more rules that match events that come from the sender account.

answer A

of course its A! (CloudTrail events) ---EventBridge rule---> [automation account default EventBridge event bus] ---allow---> [service accounts custom EventBridge event bus]

its A, rest don't include account creation.

B is wrong, the event is in automation account. It lacks the step to send the event from automation to service account.

Go for A https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-cross-account.html

I will go with B. Given that "listening directly to CloudTrail" is mentioned in the below AWS documentation in bullet point number 8: https://aws.amazon.com/blogs/machine-learning/onboard-users-to-amazon-sagemaker-studio-with-active-directory-group-specific-iam-roles/

It's B - create an Eventbridge rule in the source account, and point the rule to a custom event bus in the service accounts.