DOP-C02 Question 368
Single answerYour organization has implemented Service Control Policies (SCPs) to manage permissions across multiple accounts in AWS Organizations. A developer in one of the child accounts reports that they are unable to create an Amazon S3 bucket, even though their IAM role has the necessary permissions. What is the most likely reason for this issue?
- A
The SCP applied to the child account explicitly denies the action to create S3 buckets.
- B
The IAM role in the child account does not have the required permissions for S3 bucket creation.
- C
The SCP applied to the root organization automatically blocks S3 bucket creation for all accounts.
- D
The developer has not been granted access to the AWS Management Console.
Show answer and explanation
Correct answer: A
Explanation
Service Control Policies (SCPs) are used to define permission guardrails in AWS Organizations. SCPs can explicitly deny or allow actions. An explicit deny in an SCP applied to the child account would block the creation of S3 buckets, regardless of the permissions granted by the IAM role. This is the most likely reason for the reported issue in this scenario.
- A. Correct.
An SCP can explicitly deny actions, overriding any permissions granted by the IAM role. If the SCP applied to the child account denies S3 bucket creation, the action will be blocked regardless of the IAM role's permissions.
- B. Incorrect.
While IAM role permissions are important, they alone cannot override an explicit deny in an SCP. If the SCP denies the action, even valid IAM permissions will not allow the action.
- C. Incorrect.
SCPs applied at the root are not automatically restrictive. They must be explicitly configured to deny or allow specific actions. Without an explicit deny in the root SCP, this is unlikely the issue.
- D. Incorrect.
Access to the AWS Management Console is unrelated to the ability to create resources. Even CLI or SDK calls to create an S3 bucket would fail if an SCP explicitly denies the action.