An enterprise runs an AWS Control Tower landing zone with workload accounts grouped under a Production organisational unit. A new policy requires that every account in that organisational unit must block public access on all Amazon S3 buckets, and the security team must also be alerted whenever an account drifts from this expectation. The platform team wants to satisfy both the hard block and the ongoing visibility using native AWS Control Tower controls applied at the organisational unit, rather than writing and patching its own automation in each account. Which TWO controls should the team enable on the Production organisational unit? (Select TWO.)
- AEnable an AWS Control Tower preventive control, implemented as a service control policy, that denies the S3 public-access configuration actions across every account in the Production organisational unit. Correct
- BEnable an AWS Control Tower detective control, implemented as an AWS Config rule, that flags any account in the Production organisational unit whose buckets drift away from the blocked-public-access expectation. Correct
- CAttach an IAM permissions boundary to every role inside each Production account that caps the maximum permissions so that the S3 public-access actions can never be granted to any application principal.
- DWrite a custom AWS Lambda remediation function in each account, triggered on an Amazon EventBridge schedule, that scans the buckets nightly and resets any that have public access enabled.
- EEnable Amazon Macie in every Production account so that it discovers buckets with public access and classifies the sensitive data they hold for the security team to review.
Why A is correct: A Control Tower preventive control is delivered as an SCP attached to the organisational unit, so it stops the disallowed S3 public-access actions outright in every account, satisfying the hard block requirement centrally.
Why B is correct: A Control Tower detective control runs as a managed Config rule across the organisational unit, continuously evaluating accounts and raising non-compliance so the security team gains the ongoing drift visibility the policy demands.
Why C is wrong: Permissions boundaries must be attached per role inside each account and a local administrator can create a role without one, so this is neither a Control Tower control nor a reliable organisational-unit-wide block.
Why D is wrong: A per-account Lambda scanner is exactly the self-built automation the team wants to avoid, it only remediates after the fact on a schedule, and it is not a managed Control Tower control.
Why E is wrong: Macie discovers and classifies sensitive data and reports public buckets, but it neither prevents the public-access configuration nor is it a Control Tower organisational-unit control for enforcing this expectation.