SCS-C02 Question 301
Single answerA company is using AWS Organizations with Service Control Policies (SCPs) applied to Organizational Units (OUs). An IAM user in a member account is trying to launch an EC2 instance using a specific instance type but is unable to do so. Which of the following steps would best help resolve the issue?
- A
Check the IAM user's inline and managed policies to ensure they allow EC2 instance launches for the required instance type.
- B
Verify that the Service Control Policy (SCP) attached to the OU allows EC2 instance launches for the required instance type.
- C
Modify the EC2 service quota in the AWS account to allow the required instance type to be used.
- D
Add the 'AdministratorAccess' policy to the IAM user to override the SCP restrictions.
Show answer and explanation
Correct answer: B
Explanation
In AWS Organizations, SCPs are used to restrict or allow permissions across accounts in an OU. If an action is being blocked, it is critical to verify whether the SCP applied to the account or OU is denying the action, even if the IAM permissions for the user seem correct. IAM policies cannot override SCP restrictions, and service quotas are unrelated to permissions management.
- A. Incorrect.
This step is important to ensure the IAM user has the necessary permissions, but SCPs applied at the OU level can still block actions even if the IAM user has the correct permissions defined in their policies. Therefore, this may not resolve the issue if the SCP is restrictive.
- B. Correct.
SCPs define the maximum set of permissions allowed for accounts within an OU. If the SCP denies the action, even with proper IAM permissions, the action will still be blocked. Verifying and potentially updating the SCP is the correct approach in this scenario.
- C. Incorrect.
Service quotas are separate from permission management and are used to control resource limits in AWS. An EC2 service quota would not block permissions for launching a specific instance type.
- D. Incorrect.
SCPs cannot be overridden by IAM policies, even with 'AdministratorAccess.' SCPs define the maximum permissions, and actions denied by SCPs cannot be performed, regardless of IAM permissions.