SOA-C03 practice question: Organizations, SCPs and IAM Identity Center

Security and Compliance A free question from our original SOA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.

A pet insurer's compliance policy states that workloads may run only in us-east-1 and us-west-2. The company uses AWS Organizations, and some member account teams have full administrator access in their accounts. A CloudOps engineer must prevent resources from being created in any other Region, including by those administrators, without breaking access to global services such as IAM and Route 53. What should the engineer do?

Choose one answer.

A. Create an AWS Config rule in each account that flags resources in other Regions, with automatic remediation that deletes them.
B. Attach an IAM policy to every IAM role in each account that denies actions when aws:RequestedRegion is not one of the two Regions.
C. Create an IAM Identity Center permission set with the Region restriction and assign it to every user who signs in to the member accounts.
D. Attach an SCP to the organization's root that denies actions when aws:RequestedRegion is not one of the two Regions, exempting global services with NotAction.

Show the answer and explanation

Answer: D

A. Wrong: Config detects resources after they are created and can remediate them, but it does not prevent creation. Administrators could also change or remove the rule in their own accounts. Learn more: AWS Config rules (opens in a new tab)
B. Wrong: Account administrators can edit or detach IAM policies in their own accounts. The restriction would not hold against the people it most needs to cover. Learn more: AWS global condition context keys (opens in a new tab)
C. Wrong: Permission sets apply only to users who sign in through IAM Identity Center. Existing administrators with other access, including IAM users and roles in the account, would not be restricted. Learn more: Permission sets in IAM Identity Center (opens in a new tab)
D. Right: Correct. SCPs set the maximum permissions for every principal in member accounts, including administrators, and they cannot be changed from inside a member account. The NotAction exemption keeps global services such as IAM and Route 53 working. Learn more: General examples of service control policies (opens in a new tab)

Explanation

Service control policies are the preventive guardrail for member accounts in AWS Organizations, because no one inside a member account can bypass them. A Region-restriction SCP denies requests based on aws:RequestedRegion and exempts global services, whose requests are recorded in us-east-1. Config rules detect after the fact, and IAM policies can be changed by account administrators.

SOA-C03 practice question: Organizations, SCPs and IAM Identity Center

Explanation

Study

Keep practicing