DOP-C02 Question 370
Single answerYour organization has implemented AWS Organizations and is using Service Control Policies (SCPs) to enforce compliance across multiple AWS accounts. A new SCP has been created to explicitly deny the ability to delete S3 buckets for all accounts in the organization. However, an administrator in one of the accounts reports that they are still able to delete S3 buckets. What could be the most likely reason for this behavior?
- A
The SCP is not attached to the root organizational unit (OU) or the specific OU containing the account.
- B
SCPs only apply to IAM users and roles, not root users in AWS accounts.
- C
The SCP was created but was not attached to the AWS Organization itself.
- D
The administrator has an IAM policy explicitly allowing S3 bucket deletions, which overrides the SCP.
Show answer and explanation
Correct answer: A
Explanation
Service Control Policies (SCPs) are a powerful way to control access across AWS accounts within an organization. However, for an SCP to be effective, it must be attached to the appropriate organizational unit (OU), the root of the organization, or specific accounts. If the SCP is not correctly attached, it will not enforce its restrictions, even if properly configured. This is a common issue when managing SCPs, as their scope of enforcement depends on their attachment in the Organizational hierarchy.
- A. Correct.
SCPs only take effect when attached to an OU, the root, or specific AWS accounts. If the SCP is not attached to the appropriate hierarchy level, it will not enforce restrictions.
- B. Incorrect.
SCPs do apply to root users in member accounts. However, they must be correctly attached to the appropriate hierarchy level to take effect.
- C. Incorrect.
SCPs cannot be attached to the AWS Organization itself; they are attached to OUs, accounts, or the root of the organization.
- D. Incorrect.
SCPs are evaluated before IAM policies. An SCP explicitly denying an action cannot be overridden by an IAM policy. Therefore, this is not the cause of the issue.