Exam AWS Certified DevOps Engineer - Professional DOP-C02 topic 1 question 334 discussion

❌ Why not the others? A. While a Lambda in a new account can work, it’s better to use a delegated admin for AWS Config management. C. EventBridge doesn’t emit events when an OU is registered or re-registered. This is not a valid trigger. D. Modifying the AWSControlTowerExecution role in each account breaks the Control Tower managed roles and is not recommended.

These steps ensure that the customizations are applied consistently across all existing and new AWS accounts, leveraging the delegated administrator account for centralized management and automation123.

C covers OU registration/re-registration events⁠ F handles account enrollment, updates, and landing zone changes⁠ ⁠​E's role in providing the necessary IAM permissions structure: Creates proper IAM role in Control Tower management account Enables assumption of AWSControlTowerExecution IAM role across accounts

https://aws.amazon.com/solutions/guidance/customizing-aws-config-resources-in-aws-control-tower/ - Need eventbridge in CT management acct to react to CT lifecycle events - need CT management acct lambda function to assume AWSControlTowerExecution role and customise config. - If lambda is not in CT management acct then it will need to assume a role in CT management acct which has trust with AWSControlTowerExecution role in member accts

I think there is a misspelling in the A option as it's said just "Create a new AWS account" when it should said " Create a new AWS account as an AWS Config delegated administrator.", said that, I go for AEF.

B, E, and F. B: AWS Config supports delegated administrators, allowing a central account to manage configurations across the organization. By creating a Lambda function in the delegated administrator account, you can apply the customizations to the AWS Config configuration recorder in all member accounts centrally. E: The AWSControlTowerExecution IAM role exists in each enrolled account and allows centralized operations. The IAM role in the management account needs permissions to assume the AWSControlTowerExecution role in member accounts. F: AWS Control Tower emits events when an account is enrolled or updated, or when the landing zone is updated. An EventBridge rule can trigger the Lambda function to ensure that any new or updated accounts automatically receive the customizations. Re-registering each OU ensures that Control Tower applies its governance to all accounts and OUs consistently.