SOA-C02 Question 181
Select 3An organization uses AWS Organizations with Service Control Policies (SCPs) to manage permissions across its accounts. They have created an SCP that explicitly denies access to the 'ec2:TerminateInstances' action. However, an IAM user in one of the member accounts still claims they can terminate EC2 instances. What steps should you take to validate and troubleshoot this issue?
- A
Verify that the SCP is attached to the organizational unit (OU) or account where the IAM user resides.
- B
Check whether the IAM user's permissions boundary allows the 'ec2:TerminateInstances' action.
- C
Review the IAM policy attached to the IAM user or their group to see if it explicitly allows the 'ec2:TerminateInstances' action.
- D
Ensure that the IAM user is not using a root account or an account with full administrator privileges.
- E
Confirm that the SCP has been enabled for the organization in AWS Organizations.
Show answer and explanation
Correct answers: A, B, D
Explanation
To troubleshoot why an SCP is not restricting access as intended, the first step is to ensure the SCP is attached to the correct OU or account. Next, validate whether the IAM user's permissions boundary allows the action, as permissions boundaries can override SCPs for IAM users and roles. Finally, confirm that the user is not using a root account or full administrator privileges, as such accounts are not affected by SCPs. SCPs are automatically enabled in AWS Organizations, so there is no need to validate their enablement.
- A. Correct.
The SCP must be attached to the appropriate OU or account to take effect. If it's not attached, it won't apply to the IAM user, even if the SCP is correctly configured.
- B. Correct.
Permissions boundaries act as a guardrail for IAM users and roles. If the boundary permits the 'ec2:TerminateInstances' action, the user might still have access, depending on other policies.
- C. Incorrect.
While IAM policies are important, an SCP that explicitly denies an action should override any IAM policy that allows it. Therefore, IAM policies alone wouldn't explain why the user still has access.
- D. Correct.
If the user has root or full administrator privileges, they are not restricted by SCPs, as SCPs only apply to IAM users and roles, not to the root account.
- E. Incorrect.
SCPs are automatically enabled for all organizations created in AWS Organizations. There is no separate step to 'enable' SCPs, so this option is irrelevant.