Organizations, SCPs and IAM Identity Center: SOA-C03 study notes and practice questions
What to know about Organizations, SCPs and IAM Identity Center for the SOA-C03 exam, from the Security and Compliance domain (16% of the exam guide), then 1 free question to test it. Part of the SOA-C03 study guide.
Multi-account questions ask how to enforce rules everywhere and give people access to the right accounts.
AWS Organizations
OUs group accounts by function (Security, Infrastructure, Workloads/Prod, Workloads/Dev, Sandbox). Policies attached to an OU apply to every account below it.
Service control policies (SCPs) are preventive guardrails: nobody in a member account, including its administrators and root user, can exceed them. Common uses: allow only approved Regions, stop CloudTrail or GuardDuty being turned off, stop accounts leaving the organization.
Resource control policies (RCPs) set the maximum access to resources such as S3 buckets and KMS keys, for example to block anyone outside the organization.
Tag policies, backup policies and AI services opt-out policies standardize settings.
Delegated administrators let a security or operations account run services such as GuardDuty, Security Hub, Config, StackSets and AWS Backup for the organization, keeping the management account clean.
AWS Control Tower
Sets up a landing zone with log archive and audit accounts, an organization trail and controls (guardrails): preventive (SCPs and RCPs), detective (Config rules) and proactive (CloudFormation hooks that check resources before they are created). Account Factory creates new accounts with the baseline applied.
IAM Identity Center
One place for workforce sign-in to all accounts, using its own directory, Active Directory, or an external identity provider (SAML/SCIM).
Permission sets define job permissions once (such as ReadOnly, Operator, Admin) and become roles in each assigned account.
Users get temporary credentials; the CLI signs in with aws sso login.
Common traps
SCPs on the management account. They don’t apply there.
IAM users in every account for each employee. Use IAM Identity Center.
Config rules to prevent actions. Config detects; SCPs prevent.
A pet insurer's compliance policy states that workloads may run only in us-east-1 and us-west-2.
The company uses AWS Organizations, and some member account teams have full administrator access in their accounts.
A CloudOps engineer must prevent resources from being created in any other Region, including by those administrators, without breaking access to global services such as IAM and Route 53.
What should the engineer do?
Choose one answer.
AA. Create an AWS Config rule in each account that flags resources in other Regions, with automatic remediation that deletes them.
BB. Attach an IAM policy to every IAM role in each account that denies actions when aws:RequestedRegion is not one of the two Regions.
CC. Create an IAM Identity Center permission set with the Region restriction and assign it to every user who signs in to the member accounts.
DD. Attach an SCP to the organization's root that denies actions when aws:RequestedRegion is not one of the two Regions, exempting global services with NotAction.
Show the answer and explanation
Answer: D
A. Wrong: Config detects resources after they are created and can remediate them, but it does not prevent creation. Administrators could also change or remove the rule in their own accounts. Learn more: AWS Config rules (opens in a new tab)
D. Right: Correct. SCPs set the maximum permissions for every principal in member accounts, including administrators, and they cannot be changed from inside a member account. The NotAction exemption keeps global services such as IAM and Route 53 working. Learn more: General examples of service control policies (opens in a new tab)
Explanation
Service control policies are the preventive guardrail for member accounts in AWS Organizations, because no one inside a member account can bypass them. A Region-restriction SCP denies requests based on aws:RequestedRegion and exempts global services, whose requests are recorded in us-east-1. Config rules detect after the fact, and IAM policies can be changed by account administrators.
Want more on Organizations, SCPs and IAM Identity Center? The 5 full-length practice sets have 6 more Organizations, SCPs and IAM Identity Center questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →