Examkin

Question

Difficulty: MediumMulti-Account Governance and Organizational Structure

An enterprise is designing its multi-account governance strategy using AWS Organizations. The security team wants to achieve the following:

1. Prevent all member accounts under the "Development" Organizational Unit (OU) from deploying resources outside of us-east-1 and us-west-2.
2. Restrict the "Production" OU so that only a specific list of approved EC2 instance types can be launched, while ensuring that administrators in individual production accounts can still manage their own local IAM permissions for launching those instances.

Which TWO of the following configurations must the Solutions Architect implement to meet these requirements? (Select TWO.)

  1. Attach a Service Control Policy (SCP) to the Development OU that denies access to all AWS actions if the request is made outside of us-east-1 and us-west-2, using the aws:RequestedRegion condition key with a StringNotEquals operator.Answer
  2. Attach a Service Control Policy (SCP) to the Production OU that denies the ec2:RunInstances action if the ec2:InstanceType condition key does not match the approved list, and configure local IAM policies in the production accounts to explicitly grant the ec2:RunInstances permission.Answer
  3. C
    Attach an SCP to the Production OU that explicitly allows the ec2:RunInstances action for approved instance types, which automatically authorizes the local administrator roles to launch these instances without local IAM policy modifications.
  4. D
    Attach an SCP to the Root of the organization that allows all services in us-east-1 and us-west-2, which will implicitly deny access to all other regions for the Development OU without affecting other OUs.
  5. E
    Configure an SCP that restricts S3 bucket creation to require encryption using the AWS-managed KMS key (aws/s3) for cross-account S3 buckets, and share this key across all organizational OUs.

Answer

Attach a Service Control Policy (SCP) to the Development OU that denies access to all AWS actions if the request is made outside of us-east-1 and us-west-2 using the aws:RequestedRegion key with a StringNotEquals operator, and attach an SCP to the Production OU that denies the ec2:RunInstances action if the ec2:InstanceType condition key does not match the approved list, while configuring local IAM policies in the production accounts to explicitly grant the ec2:RunInstances permission.
The correct strategy combines a regional restriction SCP using aws:RequestedRegion at the Development OU level with a instance-type filtering SCP at the Production OU level. The regional restriction SCP effectively blocks API calls outside us-east-1 and us-west-2. The instance-type restriction SCP acts as a guardrail, while local IAM policies in the production accounts explicitly grant permissions to launch the allowed instance types, conforming to the policy evaluation logic where an action is allowed only if both the SCP and IAM policies permit it.

Step-by-Step Solution

1
Evaluate the regional restriction requirement for the Development OU.
Identify that a Deny-based SCP using the aws:RequestedRegion condition key with a StringNotEquals operator must be applied to the Development OU to block non-approved regions.
This establishes a robust guardrail that prevents resource creation in unapproved regions, while allowing normal operations within us-east-1 and us-west-2.
2
Determine the proper relationship between SCPs and IAM policies for the Production OU EC2 restriction.
Understand that SCPs set the maximum permissions (guardrails) and do not grant permissions directly. An SCP denying unauthorized instance types must be paired with local IAM policies that explicitly grant ec2:RunInstances.
To adhere to the principle of least privilege, the local administration team must be granted access locally, while the organization-level SCP ensures they cannot exceed the guardrails set by the security team.

Key Concept

Service Control Policies (SCPs) define permission guardrails but do not grant permissions directly; they must be paired with local IAM policies to allow actions.
Rate this question

Topics

Multi-Account Governance and Organizational Structure

More questions from this topic