An organization wants to ensure that its developers can create resources in a sandbox Organizational Unit (OU) but are strictly prevented from using any AWS services outside the us-east-1 and us-west-2 Regions. The solutions architect wants to apply this guardrail centrally across all accounts in the sandbox OU without modifying individual IAM roles or users. Which approach should the solutions architect use to meet these requirements?
- ADefine an IAM policy in the organization's management account that denies actions outside us-east-1 and us-west-2, expecting it to be inherited by all local IAM users and roles in member accounts.
- Attach a Service Control Policy (SCP) to the sandbox Organizational Unit that denies all actions unless the requested region is us-east-1 or us-west-2.Cevap
- CUse AWS Resource Access Manager (RAM) to share a region-restricting IAM policy from the management account to all member accounts in the sandbox Organizational Unit.
- DConfigure a Customer Managed Key in AWS Key Management Service with a key policy that restricts access to us-east-1 and us-west-2, and enforce its use for all services in the sandbox Organizational Unit.
Cevap
Attach a Service Control Policy (SCP) to the sandbox Organizational Unit that denies all actions unless the requested region is us-east-1 or us-west-2.
Attaching a Service Control Policy (SCP) to the sandbox Organizational Unit (OU) allows the organization to define permission guardrails that centrally restrict member accounts. An SCP containing a Deny rule with a condition evaluating the requested region ensures that no API requests can be executed outside the specified regions, regardless of local administrator permissions.
Adım Adım Çözüm
Anahtar Kavram
Service Control Policies (SCPs) in AWS Organizations are used to establish security and compliance guardrails across multiple accounts at the OU or account level.
Tahmini Süre:45s