SOA-C02 Question 183
Single answerAn organization has implemented Service Control Policies (SCPs) at the root level of its AWS Organization to enforce security controls. However, a SysOps Administrator notices that a user within a child account is still able to create resources that should have been restricted by the SCP. What action should the SysOps Administrator take to validate why the SCP is not being enforced?
- A
Verify that the SCP is attached to the AWS Organization root or the relevant Organizational Unit (OU).
- B
Check if the IAM policy attached to the user explicitly allows the restricted actions.
- C
Ensure that the permissions boundary for the IAM role used by the user aligns with the SCP restrictions.
- D
Use the AWS IAM Policy Simulator to test the SCP's effect on the user's permissions.
Show answer and explanation
Correct answer: A
Explanation
To enforce SCP restrictions, the SCP must be correctly attached to the root, Organizational Unit (OU), or account. If an SCP is not enforced, the first step is to verify its attachment. Other mechanisms like IAM policies and permissions boundaries are separate from SCP enforcement and do not influence SCP application. Testing IAM policies in the Policy Simulator will not provide insights into SCP behavior.
- A. Correct.
SCPs must be attached at the root, Organizational Unit (OU), or account level to apply. If the SCP is not attached correctly, it will not be enforced.
- B. Incorrect.
IAM policies define permissions for users or roles within an account, but they are overridden by SCPs when SCPs are applied. This is not the primary step to validate why the SCP is not enforced.
- C. Incorrect.
Permissions boundaries are account-level constraints and do not affect SCPs, which are organization-level mechanisms. While permissions boundaries should align with SCPs, they are not the cause of the SCP not being enforced.
- D. Incorrect.
The IAM Policy Simulator is used to test IAM policies and permissions, but it does not simulate the effects of SCPs. Therefore, it cannot validate why the SCP is not being enforced.