Examkin

Question

Difficulty: EasyMulti-Account Governance and Organizational Structure

An organization wants to ensure that its developers can create resources in a sandbox Organizational Unit (OU) but are strictly prevented from using any AWS services outside the us-east-1 and us-west-2 Regions. The solutions architect wants to apply this guardrail centrally across all accounts in the sandbox OU without modifying individual IAM roles or users. Which approach should the solutions architect use to meet these requirements?

  1. A
    Define an IAM policy in the organization's management account that denies actions outside us-east-1 and us-west-2, expecting it to be inherited by all local IAM users and roles in member accounts.
  2. Attach a Service Control Policy (SCP) to the sandbox Organizational Unit that denies all actions unless the requested region is us-east-1 or us-west-2.Answer
  3. C
    Use AWS Resource Access Manager (RAM) to share a region-restricting IAM policy from the management account to all member accounts in the sandbox Organizational Unit.
  4. D
    Configure a Customer Managed Key in AWS Key Management Service with a key policy that restricts access to us-east-1 and us-west-2, and enforce its use for all services in the sandbox Organizational Unit.

Answer

Attach a Service Control Policy (SCP) to the sandbox Organizational Unit that denies all actions unless the requested region is us-east-1 or us-west-2.
Attaching a Service Control Policy (SCP) to the sandbox Organizational Unit (OU) allows the organization to define permission guardrails that centrally restrict member accounts. An SCP containing a Deny rule with a condition evaluating the requested region ensures that no API requests can be executed outside the specified regions, regardless of local administrator permissions.

Step-by-Step Solution

1
Identify the requirement to apply a centralized regional guardrail across all accounts in a specific Organizational Unit.
Determine that Service Control Policies (SCPs) are the primary AWS feature used to apply guardrails across member accounts in an organization.
SCPs act as filters to restrict the maximum permissions available to member accounts in an OU.
2
Formulate a policy with a Deny effect that targets the NotEquals condition for the aws:RequestedRegion key with values us-east-1 and us-west-2.
Create an SCP that blocks actions outside the approved regions.
This ensures any API request made to a region other than the specified ones is blocked.
3
Attach the SCP to the target sandbox Organizational Unit (OU) rather than individual member accounts or local IAM identities.
All accounts inside the sandbox OU immediately inherit the regional restriction.
Attaching the policy at the OU level provides centralized governance with minimal operational overhead.

Key Concept

Service Control Policies (SCPs) in AWS Organizations are used to establish security and compliance guardrails across multiple accounts at the OU or account level.
Estimated Time:45s
Rate this question

Topics

Multi-Account Governance and Organizational Structure

More questions from this topic