SCS-C02 Question 434
Single answerAn organization uses AWS Organizations and has implemented Service Control Policies (SCPs) to establish guardrails for its accounts. A security engineer is tasked with ensuring that no account in the organization can create or modify IAM roles with administrative permissions, while still allowing other administrative operations for specific accounts. Which approach should the security engineer take to enforce this requirement?
- A
Create an SCP that explicitly denies the 'iam:CreateRole' and 'iam:PutRolePolicy' actions with a condition that checks for 'AdministratorAccess' policy attachment.
- B
Create an SCP that denies all IAM actions at the organizational level and attach it to all accounts.
- C
Create an SCP that explicitly denies IAM actions for the root account only and apply it to the organization root.
- D
Create an SCP that allows only read-only IAM actions and attach it to specific accounts.
Show answer and explanation
Correct answer: A
Explanation
Service Control Policies (SCPs) are used in AWS Organizations to define guardrails and enforce security policies. In this scenario, the goal is to restrict the creation or modification of IAM roles with administrative permissions while allowing other administrative operations. By using an SCP that explicitly denies the 'iam:CreateRole' and 'iam:PutRolePolicy' actions with a condition targeting the 'AdministratorAccess' policy, the organization achieves this requirement. This ensures that no account can bypass the restriction while still permitting other operations.
- A. Correct.
This is the correct approach. By explicitly denying 'iam:CreateRole' and 'iam:PutRolePolicy' actions with a condition targeting 'AdministratorAccess', the SCP restricts accounts from creating or modifying roles with administrative privileges without impacting other IAM operations.
- B. Incorrect.
This would overly restrict IAM actions across all accounts in the organization, which is not aligned with the requirement to allow other administrative operations for specific accounts.
- C. Incorrect.
Denying IAM actions for the root account only does not address the requirement to prevent creating or modifying IAM roles with administrative permissions across all accounts.
- D. Incorrect.
This approach overly restricts IAM actions by allowing only read-only actions, which does not meet the requirement to permit other administrative operations for specific accounts.