Examkin

Question

Difficulty: MediumMulti-Account Governance and Organizational Structure

An enterprise is configuring a multi-account governance model using AWS Organizations. The security team wants to restrict the member accounts in the Applications Organizational Unit (OU) to a subset of approved AWS services. A cloud engineer proposes attaching a Service Control Policy (SCP) to the Applications OU that lists only the approved services in an Allow statement, and then removing the default FullAWSAccess policy from the OU. Which of the following describes the effect of this configuration on the permissions of users in the member accounts, and the required next steps?

  1. A
    The SCP directly grants permissions to the approved services to all IAM users and roles in the Applications OU, allowing them to access the services without needing local IAM policies.
  2. B
    The SCP will block all access to the approved services unless a trust relationship is configured on the local IAM roles to allow the sts:AssumeRoleWithSAML action from the organization's management account.
  3. The SCP acts as a guardrail that defines the maximum allowed permissions, meaning users in the Applications OU will have no access until local IAM policies in their respective accounts are configured to grant permissions to those approved services.Answer
  4. D
    The SCP will block access to the services unless a Route 53 Private Hosted Zone for the approved services is associated with every VPC in the member accounts under the Applications OU.

Answer

The SCP acts as a guardrail that defines the maximum allowed permissions, meaning users in the Applications OU will have no access until local IAM policies in their respective accounts are configured to grant permissions to those approved services.
The correct option is the one stating that the SCP acts as a guardrail defining the maximum allowed permissions. SCPs do not grant permissions directly; they only set the boundaries. Therefore, local IAM policies in the member accounts must still explicitly grant access to the approved services for any user or role to interact with them.

Step-by-Step Solution

1
Analyze the role of Service Control Policies (SCPs) in AWS Organizations.
SCPs specify the maximum permissions for the affected member accounts but do not grant permissions.
To determine how the proposed configuration affects authorization, we must distinguish between guardrails and authorization.
2
Analyze the interaction between the SCP and local IAM policies.
For an action to be authorized, it must be allowed by both the SCP (or not explicitly denied) and the local IAM policy.
This intersection determines the effective permissions of any principal in a member account.
3
Evaluate the outcome of replacing the default FullAWSAccess policy with a custom Allow-list SCP.
Only the listed services are permitted in the member accounts, but local IAM policies must still explicitly grant access to these services.
Since the SCP only restricts the ceiling of permissions, explicit local grants are required to authorize actions.

Key Concept

Interaction between Service Control Policies (SCPs) and local IAM Policies
Estimated Time:2m 0s
Rate this question

Topics

Multi-Account Governance and Organizational Structure

More questions from this topic