SCS-C02 Question 432
Single answerYour organization has adopted AWS Organizations to manage multiple AWS accounts. You are tasked with ensuring that all member accounts adhere to a security policy that prohibits the use of specific AWS regions for resource deployment. Which feature should you use to implement this requirement effectively?
- A
Service Control Policies (SCPs) to enforce restrictions across accounts in the organization
- B
IAM Policies to restrict access to specific AWS regions
- C
AWS Config Rules to detect and remediate non-compliance in member accounts
- D
AWS Control Tower to create and apply a preventive guardrail
Show answer and explanation
Correct answer: A
Explanation
Service Control Policies (SCPs) are the appropriate solution for implementing organization-wide guardrails in AWS Organizations. They allow you to define and enforce policies that restrict or allow specific actions across all accounts in the organization. In this scenario, SCPs can be used to prevent resources from being deployed in certain AWS regions, providing a preventive control mechanism that aligns with the organization's security requirements.
- A. Correct.
Service Control Policies (SCPs) are designed to define guardrails at the organizational level in AWS Organizations. They are the correct choice for enforcing restrictions across accounts, such as disallowing the use of specific AWS regions.
- B. Incorrect.
IAM Policies are applied at the resource or user level within individual accounts, not across multiple accounts. They cannot enforce organization-wide guardrails.
- C. Incorrect.
AWS Config Rules are used to detect and report compliance issues but do not provide preventive enforcement like SCPs. They are reactive rather than proactive.
- D. Incorrect.
AWS Control Tower uses preventive guardrails but is not the correct tool for this scenario. While it provides a framework for governance, SCPs are the specific mechanism used to enforce these types of policies in AWS Organizations.