DOP-C02 Question 367
Single answerYour organization uses AWS Organizations with Service Control Policies (SCPs) to enforce governance controls. A new SCP has been created to deny the ability to delete S3 buckets across all accounts in the organization. However, one of the accounts still allows users with sufficient IAM permissions to delete S3 buckets. What is the most likely reason the SCP is not working as intended?
- A
The SCP is not attached to the organizational unit (OU) or account where the issue is occurring.
- B
The SCP is written with a syntax error, causing it to fail silently.
- C
The IAM policies in the account explicitly allow bucket deletion, overriding the SCP.
- D
The SCP is configured to only log actions instead of enforcing restrictions.
Show answer and explanation
Correct answer: A
Explanation
SCPs in AWS Organizations are effective only when attached to the appropriate organizational unit (OU) or account. If the SCP is not attached, it will not apply to the accounts or resources within that scope. This is the most likely reason why users in the account are still able to delete S3 buckets despite the SCP being created.
- A. Correct.
SCPs only take effect if they are attached to an organizational unit (OU) or account. If the SCP is not attached to the correct OU or account, it will have no impact.
- B. Incorrect.
If the SCP had a syntax error, it would fail validation and could not be created or attached. AWS does not allow SCPs with syntax errors to take effect.
- C. Incorrect.
IAM policies cannot override SCPs. SCPs act as a filter, and any action explicitly denied by an SCP will remain denied, regardless of IAM policies.
- D. Incorrect.
SCPs are always enforced when attached. They do not have a 'log-only' mode. Actions not permitted by an SCP are blocked.