A company uses AWS Organizations to manage its AWS accounts. The company has a root OU that has a child OU. The root OU has an SCP that allows all actions on all resources. The child OU has an SCP tha

Question

Options

• AAttach the AmazonEC2FullAccess IAM policy to the IAM user.
• BCreate a new SCP that allows all actions for Amazon EC2. Attach the SCP to the vendor-data
• CUpdate the SCP in the child OU to allow all actions for Amazon EC2.
• DCreate a new SCP that allows all actions for Amazon EC2. Attach the SCP to the root OU.

• A
  13% (5)
• B
  8% (3)
• C
  78% (31)
• D
  3% (1)

Explanation

Explanation

Option C is correct because the child OU's SCP is the actual barrier - it explicitly denies all actions except DynamoDB and Lambda, and SCPs act as guardrails that override even Administrator-level IAM permissions. Adding EC2 to the child OU's allow list removes this restriction for all accounts within it, including vendor-data.

Why the distractors are wrong:

• A is wrong because IAM policies cannot override an SCP denial - the AdministratorAccess policy is already the broadest IAM policy possible, and the SCP is still blocking EC2 regardless.
• B is wrong because SCPs cannot be attached directly to individual AWS accounts in the same way - they attach to OUs or the root, and even if this were possible, the child OU's deny would still take precedence.
• D is wrong because attaching an EC2-allow SCP to the root OU doesn't help - the child OU's explicit deny of non-DynamoDB/Lambda actions would still block EC2, since the most restrictive SCP wins when multiple SCPs apply.

Memory Tip: Think of SCPs as a ceiling and IAM policies as your reach - no matter how tall you are (AdministratorAccess), you can never touch what's above the ceiling (SCP deny). Always fix the ceiling first!

No community discussion yet for this question.