Examkin

Question

Difficulty: MediumIAM Policies, Roles, and Service Control Policies (SCPs)

An organization manages its AWS accounts using AWS Organizations with all features enabled. A SysOps administrator in a member account is troubleshooting why an IAM user (`arn:aws:iam::111122223333:user/LogOperator`) cannot delete objects from an Amazon S3 bucket named `prod-log-bucket`, despite the user having an identity-based IAM policy that allows `s3:DeleteObject` and `s3:DeleteObjectVersion` on the bucket.

The administrator discovers that the management account has applied the following Service Control Policy (SCP) to the member account:

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "RestrictDeletions",
"Effect": "Deny",
"Action": [
"s3:DeleteObject",
"s3:DeleteObjectVersion"
],
"Resource": "arn:aws:s3:::prod-log-bucket/*",
"Condition": {
"ArnNotEquals": {
"aws:PrincipalArn": "arn:aws:iam::111122223333:role/LogCleanupRole"
}
}
}
]
}

Why is the IAM user unable to delete objects from the S3 bucket?

  1. The SCP contains an explicit Deny statement that applies to all principals in the member account except the specified LogCleanupRole, which overrides the IAM user's Allow permission.Answer
  2. B
    The IAM user has not been granted the iam:PassRole permission to assume the LogCleanupRole, which is required to bypass the SCP restriction.
  3. C
    The S3 bucket policy in the member account must explicitly trust the management account's SCP before the exclusion rule can be applied.
  4. D
    The IAM user is connecting from a subnet whose route table lacks a route to the S3 gateway VPC endpoint, causing the condition key to fail validation.

Answer

The Service Control Policy (SCP) contains an explicit Deny statement that applies to all principals in the member account except the specified LogCleanupRole, which overrides the IAM user's Allow permission.
The correct answer explains that the SCP contains an explicit Deny statement that applies to all principals except the LogCleanupRole. Since the user LogOperator is not the LogCleanupRole, the explicit Deny is triggered. In AWS policy evaluation, an explicit Deny in an SCP overrides any local identity-based Allow statements, resulting in an Access Denied error.

Step-by-Step Solution

1
Evaluate the evaluation logic of AWS policies.
By default, all requests are denied. An explicit deny in any policy (including SCPs) overrides any explicit allows.
Understanding the policy evaluation hierarchy is critical for troubleshooting access issues in multi-account environments.
2
Analyze the Service Control Policy (SCP) applied to the member account.
The SCP explicitly denies the s3:DeleteObject and s3:DeleteObjectVersion actions on the specified S3 bucket resource if the calling principal is NOT the LogCleanupRole role.
Identifying the target resource, actions, and condition criteria determines who is affected by the policy restriction.
3
Compare the calling principal's ARN with the condition pattern.
The calling principal is the IAM user LogOperator. This does not match the LogCleanupRole ARN, meaning the condition is satisfied and the explicit Deny is applied.
Evaluating the ArnNotEquals operator determines if the calling principal falls under the scope of the Deny statement.

Key Concept

AWS Organizations Service Control Policies (SCPs) act as permission guards that specify the maximum permissions for an account. An explicit Deny statement in an SCP overrides any local IAM policy Allow statements, preventing even administrative users or specific IAM users from executing restricted actions if they do not meet the condition criteria.
Rate this question

Topics

IAM Policies, Roles, and Service Control Policies (SCPs)

More questions from this topic