SCS-C02 Question 435
Single answerYour organization is using AWS Organizations to manage multiple accounts. The security team has implemented Service Control Policies (SCPs) as policy-defined guardrails to ensure compliance across the organization. A developer in one of the accounts reports that they are unable to create an Amazon EC2 instance in a specific region, even though they have the necessary IAM permissions. What is the most likely cause of this issue?
- A
The SCP applied to the organizational unit (OU) containing the account denies EC2 actions in that region.
- B
The IAM role assigned to the developer does not have permissions to create EC2 instances.
- C
The account is not subscribed to the specific AWS region where the EC2 instance is being created.
- D
The developer is using an unsupported EC2 instance type in that region.
Show answer and explanation
Correct answer: A
Explanation
Service Control Policies (SCPs) in AWS Organizations are policy-defined guardrails that limit permissions for AWS accounts, regardless of the IAM permissions granted within those accounts. In this scenario, the most likely issue is that the SCP applied to the organizational unit (OU) denies EC2 actions in the specific region, overriding the developer's IAM permissions. SCPs ensure compliance and governance by restricting operations at the organizational level.
- A. Correct.
Correct. Service Control Policies (SCPs) set the maximum level of permissions for accounts in an organization. If an SCP denies EC2 actions in a specific region, no user in the account, regardless of their IAM permissions, can perform those actions.
- B. Incorrect.
Incorrect. While IAM permissions control what actions a user can perform, SCPs take precedence and can restrict actions even if they are allowed by IAM policies.
- C. Incorrect.
Incorrect. Account subscription to specific AWS regions is not a factor controlled by SCPs and would not result in this behavior.
- D. Incorrect.
Incorrect. Unsupported EC2 instance types are unrelated to the use of SCPs and would result in a different type of error message.