An enterprise governs its multi-account environment with AWS Control Tower and is onboarding a new organisational unit for regulated workloads. Governance requires a hard block so accounts in that organisational unit can never launch resources outside two approved AWS Regions, and a continuous check that reports any account whose Amazon CloudWatch log groups lack a configured retention period without interrupting operations. The team wants to use the governance model Control Tower already provides rather than building separate tooling. Which TWO controls should they enable on the organisational unit? (Select TWO.)
- AEnable a Control Tower preventive control backed by a service control policy that denies actions in any Region outside the two approved Regions, applied to the organisational unit so disallowed-Region activity is rejected. Correct
- BWrite an AWS CloudFormation Guard rule set and run it as a pipeline stage so deployments into the organisational unit are rejected when they target a disallowed Region or omit a log retention period.
- CConfigure an AWS Config conformance pack deployed directly through StackSets to the organisational unit and rely on it alone to both deny disallowed Regions and report any missing log retention.
- DEnable a Control Tower detective control backed by an AWS Config rule that evaluates whether each account has a CloudWatch Logs retention period set and reports any non-compliant account on the dashboard without blocking work. Correct
Why A is correct: A Control Tower preventive control is implemented as a service control policy and denies actions in non-approved Regions across the organisational unit, delivering the hard Region block the regulator requires.
Why B is wrong: CloudFormation Guard only evaluates templates that pass through that pipeline, so it cannot block console or CLI actions in other Regions and is not part of the Control Tower governance model the team wants to reuse.
Why C is wrong: A conformance pack only evaluates and reports compliance, so it cannot deny disallowed-Region activity, and deploying it outside Control Tower bypasses the governance model the requirement asks the team to use.
Why D is correct: A Control Tower detective control uses an AWS Config rule to continuously evaluate log-retention configuration and flag drift on the dashboard, reporting non-compliance without interrupting operations as required.