SOA-C02 Question 184
Single answerAn organization has implemented Service Control Policies (SCPs) in AWS Organizations to restrict access to certain services and actions across multiple accounts. A SysOps Administrator is troubleshooting an issue where an IAM user is unable to perform the 's3:DeleteObject' action on an Amazon S3 bucket, even though the user has an attached IAM policy explicitly allowing this action. What should the SysOps Administrator check to resolve this issue?
- A
Ensure that the S3 bucket policy does not explicitly deny the 's3:DeleteObject' action.
- B
Verify that the SCP attached to the account allows the 's3:DeleteObject' action.
- C
Check if the IAM user's permissions boundary allows the 's3:DeleteObject' action.
- D
Confirm that the S3 bucket encryption settings are not restricting the 's3:DeleteObject' action.
Show answer and explanation
Correct answer: B
Explanation
Service Control Policies (SCPs) define the maximum permissions for accounts in an AWS Organization. Even if an IAM policy explicitly allows an action, the action will be blocked if the SCP denies it. In this scenario, verifying that the SCP attached to the account allows the 's3:DeleteObject' action is the correct step to resolve the issue. Other factors, such as bucket policies or permissions boundaries, are secondary and do not override SCPs.
- A. Incorrect.
While a bucket policy could deny access, this situation specifically involves SCPs and IAM permissions, making this option unrelated to the root cause.
- B. Correct.
SCPs are a key factor in determining whether an action is allowed at the account level. If the SCP denies the 's3:DeleteObject' action, no IAM policy or permissions boundary can override it.
- C. Incorrect.
Permissions boundaries are used to define the maximum permissions for the IAM user or role, but they do not override SCPs. Therefore, this is not the root cause in this scenario.
- D. Incorrect.
S3 bucket encryption settings do not impact the ability to perform actions like 's3:DeleteObject', so this option is irrelevant in this context.