Examkin

Question

Difficulty: Very hardMulti-Account Governance and Organizational Structure

A solutions architect is managing a multi-account environment using AWS Organizations. The organizational unit (OU) hierarchy is structured as follows:

* Root
* Workloads (OU)
* Production (OU)
* Account-A (Production member account)

The security team has removed the default FullAWSAccess Service Control Policy (SCP) from both the Workloads and Production OUs to implement a custom allow-list model. The Root OU still has FullAWSAccess attached.

The following custom SCPs are attached:

SCP-1 (attached to Workloads OU):

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowCoreServices",
"Effect": "Allow",
"Action": [
"ec2:*",
"s3:*",
"iam:*",
"sts:*"
],
"Resource": "*"
}
]
}

SCP-2 (attached to Production OU):

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowStorageAndCompute",
"Effect": "Allow",
"Action": [
"ec2:*",
"s3:*"
],
"Resource": "*"
},
{
"Sid": "DenyUnsecureStorage",
"Effect": "Deny",
"Action": "s3:PutObject",
"Resource": "arn:aws:s3:::*",
"Condition": {
"Bool": {
"aws:SecureTransport": "false"
}
}
}
]
}

In Account-A, an IAM user named PlatformAdmin has an IAM policy attached that grants administrator access ("Action": "*", "Resource": "*").

PlatformAdmin attempts to perform two actions in Account-A:
1. Create a new IAM role.
2. Upload a log file to an Amazon S3 bucket using HTTPS.

Which of the following describes the outcomes of these actions?

  1. The IAM role creation fails because IAM actions are not allowed by the SCP at the Production OU level. The S3 bucket upload succeeds because S3 actions are allowed by the SCPs at all levels and the secure transport condition in the Deny statement is not met.Answer
  2. B
    Both actions succeed because the local IAM policy grants full administrator access, and there is no explicit Deny statement for IAM actions in any of the attached SCPs.
  3. C
    Both actions fail because the default FullAWSAccess SCP was removed from the OUs, which implicitly denies all actions at the member account level unless the FullAWSAccess SCP is explicitly re-applied at the account level.
  4. D
    The IAM role creation succeeds because IAM actions are allowed by the SCP at the parent Workloads OU level. The S3 bucket upload fails because the Deny statement in SCP-2 blocks all S3 PutObject actions regardless of the transport protocol.

Answer

The IAM role creation fails because IAM actions are not allowed by the SCP at the Production OU level. The S3 bucket upload succeeds because S3 actions are allowed by the SCPs at all levels and the secure transport condition in the Deny statement is not met.
The correct answer is that the IAM role creation fails while the S3 upload succeeds. In AWS Organizations, if the default FullAWSAccess SCP is detached to implement an allow-list strategy, any action must be allowed by SCPs at every node of the path from the Root to the member account. Since the Production OU SCP (SCP-2) only allows EC2 and S3 actions, the permission chain for IAM actions is broken, causing an implicit deny for the IAM role creation. S3 actions are allowed at all levels, and the explicit Deny statement for s3:PutObject in SCP-2 does not apply because the upload is performed securely via HTTPS, failing to trigger the condition where secure transport is false.

Step-by-Step Solution

1
Evaluate the permissions path for IAM role creation (iam:CreateRole).
Allowed at Root (FullAWSAccess) -> Allowed at Workloads OU (SCP-1 allows iam:*) -> NOT allowed at Production OU (SCP-2 does not allow iam:*) -> Implicitly Denied.
For any action to succeed in a member account, it must be explicitly allowed at every level of the Organization path from the Root down to the target account when the default FullAWSAccess SCP is not present.
2
Evaluate the permissions path for S3 bucket upload (s3:PutObject) over HTTPS.
Allowed at Root (FullAWSAccess) -> Allowed at Workloads OU (SCP-1 allows s3:*) -> Allowed at Production OU (SCP-2 allows s3:*).
Confirm that S3 actions are permitted across all OUs in the path.
3
Evaluate Deny statements in SCP-2 for the S3 bucket upload.
The Deny statement blocks s3:PutObject only when aws:SecureTransport is false. Since HTTPS is used, the condition is false, and the Deny is not applied.
Explicit Deny statements with conditions must be checked to ensure they do not override the allowed path.
4
Verify local IAM permissions in the member account.
PlatformAdmin has administrator access (*:*), which permits both IAM and S3 actions locally.
Local IAM policies must also grant the required permissions, as the final access is the intersection of SCPs and local IAM policies.

Key Concept

AWS Organizations Service Control Policies (SCPs) authorization boundary and inheritance behavior in an allow-list governance model.
Rate this question

Topics

Multi-Account Governance and Organizational Structure

More questions from this topic