SOA-C03 practice question: Organizations, SCPs and IAM Identity Center
Security and Compliance A free question from our original SOA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A pet insurer's compliance policy states that workloads may run only in us-east-1 and us-west-2.
The company uses AWS Organizations, and some member account teams have full administrator access in their accounts.
A CloudOps engineer must prevent resources from being created in any other Region, including by those administrators, without breaking access to global services such as IAM and Route 53.
What should the engineer do?
Choose one answer.
AA. Create an AWS Config rule in each account that flags resources in other Regions, with automatic remediation that deletes them.
BB. Attach an IAM policy to every IAM role in each account that denies actions when aws:RequestedRegion is not one of the two Regions.
CC. Create an IAM Identity Center permission set with the Region restriction and assign it to every user who signs in to the member accounts.
DD. Attach an SCP to the organization's root that denies actions when aws:RequestedRegion is not one of the two Regions, exempting global services with NotAction.
Show the answer and explanation
Answer: D
A. Wrong: Config detects resources after they are created and can remediate them, but it does not prevent creation. Administrators could also change or remove the rule in their own accounts. Learn more: AWS Config rules (opens in a new tab)
D. Right: Correct. SCPs set the maximum permissions for every principal in member accounts, including administrators, and they cannot be changed from inside a member account. The NotAction exemption keeps global services such as IAM and Route 53 working. Learn more: General examples of service control policies (opens in a new tab)
Explanation
Service control policies are the preventive guardrail for member accounts in AWS Organizations, because no one inside a member account can bypass them. A Region-restriction SCP denies requests based on aws:RequestedRegion and exempts global services, whose requests are recorded in us-east-1. Config rules detect after the fact, and IAM policies can be changed by account administrators.
Want more on Organizations, SCPs and IAM Identity Center? The 5 full-length practice sets have 6 more Organizations, SCPs and IAM Identity Center questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →