SCS-C02 Question 260
Select 3Your company has a multi-account AWS environment, and you are tasked with ensuring that all accounts adhere to a set of security compliance requirements. To enforce governance, you decide to use AWS Organizations and Service Control Policies (SCPs). Which of the following actions can an SCP enforce within your organization?
- A
Deny the ability to disable CloudTrail logging in member accounts.
- B
Restrict the use of specific AWS Regions for all resources.
- C
Prevent the use of certain EC2 instance types across all accounts.
- D
Enforce encryption of S3 buckets using AWS Key Management Service (KMS).
- E
Mandate a specific IAM password policy for all accounts.
Show answer and explanation
Correct answers: A, B, C
Explanation
Service Control Policies (SCPs) are a powerful feature in AWS Organizations that allow you to define permission guardrails for accounts in your organization. SCPs can deny or allow actions on AWS services and resources, but they cannot enforce specific configurations like encryption settings or password policies. The correct options reflect actions that SCPs are capable of enforcing.
- A. Correct.
SCPs can explicitly deny actions such as disabling CloudTrail logging, making this a valid enforcement option.
- B. Correct.
SCPs can restrict access to AWS services and resources in specific AWS Regions, making this an enforceable action.
- C. Correct.
SCPs can prevent the use of certain EC2 instance types by denying the required actions, making this a valid use case.
- D. Incorrect.
SCPs cannot enforce encryption settings within services like S3. This would require service-specific policies or configurations.
- E. Incorrect.
SCPs do not enforce IAM password policies. Password policies need to be configured within each AWS account individually.