Exams / SCS-C03 / Study guide / Organization policies (SCPs, RCPs, declarative policies, AI opt-out)
Organization policies (SCPs, RCPs, declarative policies, AI opt-out): SCS-C03 study notes and practice questions
What to know about Organization policies (SCPs, RCPs, declarative policies, AI opt-out) for the SCS-C03 exam, from the Security Foundations and Governance domain (14% of the exam guide), then 1 free question to test it. Part of the SCS-C03 study guide.
These questions describe a rule such as “no account may disable logging,” “our data must never be reachable from outside the organization,” or “no team may create public machine images.” You pick the policy type that enforces the rule across the organization. Every organization policy is a ceiling or a setting. None of them grants access.
What decides the answer
SCPs set the maximum permissions for principals in member accounts, including the root user of those accounts. Attach them to the root, an OU or an account. The default FullAWSAccess policy must stay attached unless you replace it with an allow list.
Effective permissions are what the SCP and the identity or resource policy both allow. An SCP that allows a service does nothing on its own; the role still needs an IAM policy that grants the action.
SCPs do not affect the management account or service-linked roles. They do affect the root user of member accounts.
RCPs set the maximum permissions for access to supported resources in member accounts, for services such as S3, KMS, STS, SQS and Secrets Manager. They apply to principals inside and outside the organization, so one RCP at the root covers every bucket without editing each bucket policy. They also do not affect the management account.
Declarative policies set and enforce a configuration across the organization for supported services. Examples include requiring IMDSv2 by default for EC2, allowed AMIs, VPC Block Public Access, and blocking public sharing of AMIs and EBS snapshots.
AI services opt-out policies stop AWS AI services from using content from the covered accounts to improve those services. They are attached from the management account.
Policy types must be enabled at the organization root before you can attach policies of that type.
Exemptions are written as conditions in the SCP, for example by excluding a break-glass role or an approved automation role by ARN, so that one deny does not lock out recovery work.
How to choose
Scenario wording
Pick
Stop anyone in member accounts from disabling CloudTrail
SCP with an explicit deny
No outside principal may read our S3 buckets, whatever the bucket policy says
RCP
Every new EC2 instance must use IMDSv2 by default
Declarative policy
Stop AWS AI services from using our content to train their models
AI services opt-out policy
Let a developer role use a specific service
IAM policy on the role; an SCP only sets the ceiling
Limit what the management account can do
Not an SCP; keep workloads out and protect its root user
Common traps
Believing an SCP grants permission. It only sets a ceiling. Access still needs an identity or resource policy that allows it.
Using an SCP to stop outsiders reaching your data. RCPs and resource policies control who reaches your resources.
Expecting SCPs to bind the management account, or service-linked roles.
A broad deny on a service that breaks logging, backup or replication, because the deny has no exemption for AWS service principals or recovery roles.
Forgetting the policy type is enabled at the root before attaching the policy.
Confusing declarative policies with SCPs. Declarative policies enforce settings for supported services; SCPs limit which API actions can run.
A public university stores student records in two AWS Regions in the European Union, because of a national data residency law. The university runs many departmental accounts under one organization, and the central IT team wants to stop anyone from creating resources in other Regions.
Some global services must still work from any account, including IAM, AWS Organizations, Route 53, and CloudFront. The rule must apply to department administrators too, who can edit the IAM roles in their own accounts.
Which solution meets these requirements?
Choose one answer.
AA. Attach an SCP that denies all actions when aws:RequestedRegion is not one of the two EU Regions, with a NotAction list that exempts global services such as IAM, Organizations, Route 53, and CloudFront.
BB. Attach an SCP that denies all actions when aws:RequestedRegion is not one of the two EU Regions, with no exceptions for any service. Global services can then be used from the approved Regions only, which keeps the rule simple.
CC. Replace the FullAWSAccess SCP on the organization root with an allow list that permits actions only in the two EU Regions. Global services are then reachable from those Regions, and department administrators keep their roles.
DD. Write an IAM policy in each department administrator role that denies actions outside the two EU Regions, and have the central team review those policies each quarter. Each department keeps its own copy of the rule to maintain.
Show the answer and explanation
Answer: A
A. Right: Correct. The SCP blocks regional requests outside the approved Regions for every principal in member accounts, including administrators who edit IAM. The NotAction list keeps global services working, since their calls are not tied to one Region. Learn more: Example SCPs for Region restriction (opens in a new tab)
B. Wrong: With no exceptions, calls to IAM, Route 53, and CloudFront are denied, so administrators cannot manage roles or DNS. The rule is simple, but it breaks day-to-day work in every account.
C. Wrong: An allow list without global service exemptions has the same gap as a blanket deny, so IAM and Route 53 calls fail. Removing FullAWSAccess also changes every account, which the central team did not intend.
D. Wrong: Role policies are edited by the same administrators they are meant to restrict, so they can remove the deny. The control must apply to all administrators, and it cannot depend on who edits a role.
Explanation
An SCP with a Region condition and a NotAction list for global services blocks regional actions outside the approved Regions, even for account administrators. Blanket denies and allow lists without exemptions break global services. Deny policies written into each role can be edited by the same administrators they are meant to restrict.
Want more on Organization policies (SCPs, RCPs, declarative policies, AI opt-out)? The 5 full-length practice sets have 5 more Organization policies (SCPs, RCPs, declarative policies, AI opt-out) questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →
Study Organization policies (SCPs, RCPs, declarative policies, AI opt-out)