SCS-C02 Question 277
Single answerYour organization uses AWS Organizations with a centralized management account and several member accounts. A security audit has revealed that an IAM user in one of the member accounts has overly permissive privileges, allowing them to access resources across multiple accounts. To mitigate this, you need to ensure that no IAM user in any member account has access to resources outside their own account by default. How can you achieve this?
- A
Enable Service Control Policies (SCPs) at the root level of AWS Organizations to restrict cross-account access for all member accounts.
- B
Create IAM Policies in each member account to deny cross-account access explicitly.
- C
Use AWS Config to monitor and automatically remediate cross-account access violations.
- D
Enable AWS Organizations' Cross-Account Access Blocker to automatically prevent cross-account access.
Show answer and explanation
Correct answer: A
Explanation
Service Control Policies (SCPs) in AWS Organizations allow you to set permission boundaries at the organizational or account level. By applying an SCP at the root level of your organization that denies cross-account access by default, you can enforce this restriction across all member accounts. This approach is centralized and scalable, unlike manually managing IAM Policies in each account or relying solely on monitoring tools like AWS Config.
- A. Correct.
This is the correct answer. Service Control Policies (SCPs) allow you to define permission boundaries at the organizational level. By applying an SCP that denies cross-account access by default, you can ensure no IAM user or role in member accounts can access resources outside their own account unless explicitly allowed.
- B. Incorrect.
While IAM Policies can be used to restrict access, managing policies in each member account isn't scalable or centralized. AWS Organizations provides SCPs to enforce such restrictions across the organization efficiently.
- C. Incorrect.
AWS Config can monitor compliance, but it cannot enforce restrictions directly. It is useful for auditing and remediation, but not for directly preventing cross-account access.
- D. Incorrect.
There is no feature in AWS Organizations called 'Cross-Account Access Blocker.' This option is incorrect as it describes a non-existent service.