Examkin

Question

Difficulty: EasyMulti-Account Governance and Organizational Structure

A Solutions Architect wants to grant a development team in a member account the ability to manage Amazon S3 buckets. The architect attaches a Service Control Policy (SCP) to the Organizational Unit (OU) containing the member account, which explicitly allows all S3 actions. However, the developers in the member account still receive access denied errors when attempting to create a bucket. Which of the following explains this behavior?

  1. A
    SCPs automatically grant S3 permissions to all IAM entities in the member account, but the policy failed to apply because the member account's administrator explicitly blocked the inheritance of the policy.
  2. SCPs act as permission guardrails that define the maximum allowed permissions but do not grant access directly. The developers still require a local IAM policy in their account that explicitly grants S3 permissions.Answer
  3. C
    The S3 actions are allowed by the SCP, but the developers cannot access S3 until the S3 service is shared with the member account using a resource share in AWS Resource Access Manager.
  4. D
    The S3 permissions are allowed by the SCP, but the actions fail because S3 requires a Customer Managed Key (CMK) policy update to allow cross-account bucket access.

Answer

The correct answer states that SCPs act as permission guardrails that define the maximum allowed permissions but do not grant access directly, and that the developers still require a local IAM policy in their account that explicitly grants S3 permissions.
The correct answer states that SCPs act as permission guardrails and do not grant access directly, meaning the developers still require a local IAM policy in their account. This reflects the core concept that AWS authorization requires an explicit allow in both the SCP and the local IAM policy.

Step-by-Step Solution

1
Analyze how Service Control Policies (SCPs) interact with local Identity and Access Management (IAM) policies in AWS Organizations.
SCPs act as filters or permission boundaries. They specify the maximum possible permissions for an account but do not grant permissions directly to IAM users, groups, or roles.
To understand the evaluation logic of AWS Organizations permissions.
2
Determine the requirements for allowing an API action in a member account under an organization.
For an action to succeed, it must be explicitly allowed by both the organization's SCPs (or not explicitly denied) AND explicitly allowed by an IAM policy attached to the IAM principal in the member account.
To identify why S3 access is still denied when the SCP allows S3 actions.

Key Concept

Service Control Policies (SCPs) act as permission boundaries and do not grant permissions directly. Local IAM policies must be configured to grant access.
Estimated Time:1m 0s
Rate this question

Topics

Multi-Account Governance and Organizational Structure

More questions from this topic