An enterprise is implementing a multi-account strategy using AWS Organizations. The security team has attached a Service Control Policy (SCP) to a production Organizational Unit (OU) that explicitly denies the s3:DeleteBucket action. A developer operating within a member account under this OU has been assigned an IAM policy granting administrator access (*:*), but finds they are blocked from deleting any S3 buckets in their account. Which of the following statements correctly explains why the developer cannot delete S3 buckets?
- AThe Service Control Policy (SCP) automatically modifies the developer's local IAM policy in the member account to remove the delete permission.
- The Service Control Policy (SCP) acts as a guardrail that restricts the maximum allowed permissions, and an explicit deny in the SCP overrides any permissions granted by the local IAM policy.Cevap
- CThe Service Control Policy (SCP) automatically grants the developer all permissions except the denied action, rendering local IAM policies unnecessary.
- DThe Service Control Policy (SCP) only restricts the member account's root user and does not affect permissions granted to other IAM users or roles.
Cevap
The Service Control Policy (SCP) acts as a guardrail that restricts the maximum allowed permissions, and an explicit deny in the SCP overrides any permissions granted by the local IAM policy.
The correct option correctly states that Service Control Policies (SCPs) act as guardrails defining the maximum allowed permissions for member accounts. Under the AWS policy evaluation logic, an explicit deny in an SCP overrides any allow permissions defined in local IAM policies.
Adım Adım Çözüm
Anahtar Kavram
Service Control Policies (SCPs) act as permission filters (guardrails) and do not grant permissions directly. An explicit deny in an SCP overrides any local IAM permissions.
Tahmini Süre:45s