SOA-C02 Question 170
Single answerYour organization has recently adopted AWS Organizations to manage multiple accounts. You need to enforce a policy that restricts the creation of public S3 buckets across all member accounts. Which approach should you take to implement this security requirement?
- A
Create a Service Control Policy (SCP) that denies the
s3:PutBucketAclands3:PutBucketPublicAccessBlockactions and attach it to the root of the organization. - B
Enable AWS Config in each member account and configure a rule to detect public S3 buckets.
- C
Apply a bucket policy to all S3 buckets to deny public access.
- D
Use IAM policies in each member account to restrict access to the
s3:PutBucketAclaction.
Show answer and explanation
Correct answer: A
Explanation
To enforce organization-wide restrictions on creating public S3 buckets, Service Control Policies (SCPs) are the most appropriate solution. SCPs allow you to define and enforce permissions at the organizational level, ensuring compliance across all accounts under AWS Organizations. Other options, such as AWS Config, bucket policies, or IAM policies, are either monitoring tools or only applicable at the bucket or account level, making them unsuitable for organization-wide enforcement.
- A. Correct.
Correct. Service Control Policies (SCPs) are used in AWS Organizations to enforce security and compliance requirements across all member accounts. Denying the
s3:PutBucketAclands3:PutBucketPublicAccessBlockactions ensures public S3 buckets cannot be created in any account under the organization. - B. Incorrect.
Incorrect. AWS Config can detect and alert on non-compliant resources but does not enforce restrictions. It is useful for monitoring, not for applying preventive controls.
- C. Incorrect.
Incorrect. Bucket policies are applied at the individual bucket level and cannot enforce restrictions across multiple accounts. Managing these policies manually for all buckets in all accounts is error-prone and not scalable.
- D. Incorrect.
Incorrect. IAM policies are account-specific and do not apply organization-wide. This approach would require configuring policies in each account individually, which is less efficient and harder to manage than SCPs.