A solutions architect is auditing a multi-account AWS environment to strengthen identity and access controls. A new member AWS account is placed under an Organizational Unit (OU) that has a Service Control Policy (SCP) attached. The SCP explicitly allows only read and write actions for Amazon S3. The administrator expects the IAM users in the member account to immediately have access to Amazon S3, but the users receive 'Access Denied' errors when attempting to list S3 buckets. Which of the following explains why the users cannot access Amazon S3?
- Service Control Policies establish permission boundaries by filtering permissions but do not grant access directly; the users must also be granted permission by local IAM policies.Cevap
- BThe SCP automatically grants S3 permissions, but the default implicit deny in the member account's root user account policy overrides the SCP permissions.
- CThe S3 buckets are encrypted using AWS-managed KMS keys, which cannot be accessed by IAM users in member accounts unless the key policy is explicitly modified to delegate trust.
- DThe IAM users are attempting to access the S3 buckets through an interface VPC endpoint, and the Route 53 Private Hosted Zone for S3 has not been associated with the member account's VPC.
Cevap
Service Control Policies establish permission boundaries by filtering permissions but do not grant access directly; the users must also be granted permission by local IAM policies.
The correct option is that Service Control Policies establish permission boundaries by filtering permissions but do not grant access directly, requiring local IAM policies to grant permissions. In AWS Organizations, access is only permitted if it is allowed by both the SCP and the identity-based policy. The SCP acts as a filter, while the IAM policy acts as the grant.
Adım Adım Çözüm
Anahtar Kavram
SCPs act as permission guardrails or filters rather than permission grants. Access is only allowed when both the SCP and the local IAM policy explicitly permit the action.