Examkin

Question

Difficulty: MediumMulti-Account Governance and Organizational Structure

A software company manages its multi-account environment using AWS Organizations. The security team wants to permit developers in the Development Organizational Unit (OU) to use Amazon DynamoDB, while blocking access to all other AWS services. A solutions architect creates a Service Control Policy (SCP) that allows all DynamoDB actions and denies all other service actions, then attaches this SCP to the Development OU. After the policy is applied, developers in the Development OU report that they cannot access DynamoDB tables. Which of the following explains the cause of this issue?

  1. The developers have not been granted the necessary DynamoDB permissions via local IAM policies in their respective member accounts.Answer
  2. B
    The Service Control Policy successfully grants the DynamoDB permissions to the member accounts, but the developers are blocked because they have not been added to a local IAM group that explicitly inherits the Organization's SCP.
  3. C
    The DynamoDB tables are encrypted using AWS-managed KMS keys, which cannot be accessed by member accounts under the SCP due to policy delegation limits of AWS-managed keys.
  4. D
    The IAM roles assumed by the developers do not have the proper SAML trust relationship configured with the sts:AssumeRoleWithSAML action to allow federated access to the member accounts.

Answer

The developers have not been granted the necessary DynamoDB permissions via local IAM policies in their respective member accounts.
In AWS Organizations, Service Control Policies (SCPs) define the maximum permissions for the affected member accounts. They act as filters (guardrails) and do not grant permissions directly to any user or role. For a user or role in a member account to perform an action, the action must be permitted by both the SCP and the local IAM policy. Therefore, even if the SCP permits DynamoDB actions, the developers will be denied access unless they have local IAM policies granting them the necessary DynamoDB permissions.

Step-by-Step Solution

1
Understand the role of Service Control Policies (SCPs) in AWS Organizations.
SCPs act as guardrails that specify the maximum permissions for the affected accounts but do not grant any permissions directly.
This establishes the fundamental behavior of AWS Organizations policies.
2
Identify the relationship between SCPs and local IAM policies.
For an action to be allowed, it must be permitted by BOTH the SCP (at the Organization/OU level) and the IAM policy (within the member account).
This is the core evaluation logic of AWS IAM and Organizations policies.
3
Analyze why developers are denied access to DynamoDB.
Since the SCP allows DynamoDB, the deny must be coming from the lack of a local IAM policy granting permission, as SCPs do not grant permissions by themselves.
This resolves the discrepancy between the SCP configuration and the developers' access issues.

Key Concept

AWS Organizations Service Control Policies (SCPs) act as permission filters rather than permission grantors.
Estimated Time:1m 30s
Rate this question

Topics

Multi-Account Governance and Organizational Structure

More questions from this topic