DOP-C02 · Question #149
A company uses AWS Organizations to manage its AWS accounts. The organization root has an OU that is named Environments. The Environments OU has two child OUs that are named Development and…
The correct answer is B. All users in the Development OU will be allowed all API actions on EC2 resources. All other API. AWS Organizations uses Service Control Policies (SCPs) to manage permissions across accounts within an organization. By removing the FullAWSAccess policy and replacing it with a policy that allows all actions on Amazon EC2 resources, the effect would be that users in the…
Question
A company uses AWS Organizations to manage its AWS accounts. The organization root has an OU that is named Environments. The Environments OU has two child OUs that are named Development and Production, respectively. The Environments OU and the child OUs have the default FullAWSAccess policy in place. A DevOps engineer plans to remove the FullAWSAccess policy from the Development OU and replace the policy with a policy that allows all actions on Amazon EC2 resources. What will be the outcome of this policy replacement?
Options
- AAll users in the Development OU will be allowed all API actions on all resources.
- BAll users in the Development OU will be allowed all API actions on EC2 resources. All other API
- CAll users in the Development OU will be denied all API actions on all resources.
- DAll users in the Development OU will be denied all API actions on EC2 resources. All other API actions
How the community answered
(48 responses)- A6% (3)
- B77% (37)
- C13% (6)
- D4% (2)
Explanation
AWS Organizations uses Service Control Policies (SCPs) to manage permissions across accounts within an organization. By removing the FullAWSAccess policy and replacing it with a policy that allows all actions on Amazon EC2 resources, the effect would be that users in the Development OU can perform all actions on EC2 resources, but will be denied all other AWS actions. This is because an SCP doesn't grant permissions, but instead acts as a guardrail that defines the maximum permissions users and roles can have.
Topics
Community Discussion
No community discussion yet for this question.