SOA-C02 Question 182
Select 2An organization has implemented Service Control Policies (SCPs) to restrict certain actions across its accounts in AWS Organizations. A SysOps Administrator is troubleshooting a user’s inability to create an Amazon S3 bucket, even though the user’s IAM policy explicitly allows the 's3:CreateBucket' action. Which of the following steps should the administrator take to validate the issue?
- A
Check the effective SCPs attached to the organizational unit (OU) or account where the user resides to ensure the 's3:CreateBucket' action is allowed.
- B
Verify whether the user's permissions boundary explicitly denies the 's3:CreateBucket' action.
- C
Review the IAM role that the user is assuming to confirm it has the 's3:CreateBucket' action allowed.
- D
Ensure the root account of the management account has explicitly granted the 's3:CreateBucket' action in its policies.
- E
Verify whether a resource-based policy on an existing S3 bucket is explicitly denying the 's3:CreateBucket' action.
Show answer and explanation
Correct answers: A, B
Explanation
When troubleshooting permissions issues, SCPs and permissions boundaries are critical factors to examine in an AWS Organization. SCPs define the maximum permissions for an account or organizational unit, and permissions boundaries restrict the actions a user or role can perform. Even if an IAM policy allows an action, these mechanisms can override it and deny the request. Therefore, validating the SCPs and permissions boundaries is crucial to identifying the root cause of the user's inability to create an S3 bucket.
- A. Correct.
SCPs define the maximum permissions for accounts in an AWS Organization. If an SCP denies 's3:CreateBucket', the action will be restricted regardless of the user's IAM policy. This step is essential to validate SCPs.
- B. Correct.
Permissions boundaries act as a limit on the permissions a user or role can have. If the boundary explicitly denies 's3:CreateBucket', the action cannot be performed even if allowed by other policies.
- C. Incorrect.
While reviewing the IAM role could be useful, the scenario specifies that the user's IAM policy already allows 's3:CreateBucket.' It does not address the SCP or permissions boundary issue.
- D. Incorrect.
The root account does not directly control IAM permissions or SCPs. SCPs are managed at the organizational level, and IAM policies are attached to users, groups, or roles, not the root account.
- E. Incorrect.
Resource-based policies on an existing S3 bucket do not affect the creation of new S3 buckets. This is unrelated to the issue described in the scenario.