Exams / SAA-C03 / Multi-account governance and auditing / Question 1
SAA-C03 practice question: Multi-account governance and auditing (1 of 2)
Design Secure Architectures A free question from our original SAA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A company manages 40 AWS accounts with AWS Organizations. Data residency rules say that workloads in member accounts may run only in eu-west-2 and eu-west-1. Several teams have full administrator access in their own accounts, and the control must stop them too, before any resource is created. The teams must still be able to manage IAM roles, Amazon Route 53 records and Amazon CloudFront distributions. Which solution meets these requirements?
Choose one answer.
- AA. Attach an SCP to the root that denies requests when aws:RequestedRegion is not an approved Region, with NotAction exempting global services such as IAM.
- BB. Attach an SCP to the organisation root that denies every action when aws:RequestedRegion is not eu-west-2 or eu-west-1, with no exceptions.
- CC. Attach a permissions boundary to every administrator role in each account that allows actions only when aws:RequestedRegion is eu-west-2 or eu-west-1.
- DD. Deploy an AWS Config rule in every account and Region, with automatic remediation that deletes any resource found outside eu-west-2 and eu-west-1.
Show the answer and explanation
Answer: A
- A. Right: Correct. An SCP sets the maximum permissions for every principal in member accounts, including administrators, and blocks the request before anything is created. Global services such as IAM, Route 53 and CloudFront have endpoints in us-east-1, so they are listed in NotAction to keep them working. Learn more: SCP examples: deny access to AWS based on the requested Region (opens in a new tab)
- B. Wrong: This blocks other Regions for everyone, but it also blocks global services. Requests to IAM, Route 53 and CloudFront are served from us-east-1, so the teams could no longer manage roles, DNS records or distributions. The deny needs NotAction exemptions for those services. Learn more: SCP syntax (opens in a new tab)
- C. Wrong: Permissions boundaries are set inside each account, so an administrator with full IAM access can remove or edit the boundary on their own role, or create new roles without it. It also has the same problem with global services. An SCP is applied from outside the account and cannot be changed by its administrators. Learn more: Permissions boundaries for IAM entities (opens in a new tab)
- D. Wrong: AWS Config evaluates resources after they exist and then runs remediation, so resources would be created in other Regions for a while. It also needs recorders and rules in every Region to see them. This is a detective control, but the company needs a preventive one. Learn more: Remediating noncompliant resources with AWS Config (opens in a new tab)
Explanation
Service control policies limit what any user or role in a member account can do, even with AdministratorAccess, and they act before a request succeeds. A Region deny uses the aws:RequestedRegion condition key. Because global services such as IAM, Route 53 and CloudFront are served from us-east-1, the policy must exempt them with NotAction, or the teams lose access to them. SCPs do not affect the management account.
Study
Keep practising
Answer questions with a score at the end, or practise just this topic with the explanation after each one. No sign-up needed.