A company uses an organization in AWS Organizations to manage multiple AWS accounts. The company has enabled all features for the organization. The member accounts under one OU contain S3 buckets…

Question

Options

• ACreate an SCP in the management account of the organization to restrict Amazon S3 actions by
• BCreate an IAM permissions boundary in the management account of the organization to restrict
• CConfigure AWS Resource Access Manager (AWS RAM) to restrict access to S3 buckets in the
• DCreate a resource control policy (RCP) in the management account of the organization to restrict

• A
  76% (32)
• B
  7% (3)
• C
  14% (6)
• D
  2% (1)

Explanation

To restrict access to S3 buckets so that only IAM principals from within the AWS Organization can access them, an SCP (Service Control Policy) with conditions using the aws:PrincipalAccount or preferably aws:PrincipalOrgID can be applied at the OU level. SCPs restrict the maximum permissions for IAM entities in member accounts and can be used to enforce access control policies across accounts. The aws:PrincipalAccount condition restricts access to principals from specific accounts, while aws:PrincipalOrgID restricts based on the organization ID. IAM permissions boundaries (Option B) cannot be applied organization-wide and do not enforce restrictions across accounts. AWS RAM (Option C) is for sharing resources but does not restrict S3 bucket access based on organizational principals. There is no such thing as an RCP in AWS Organizations (Option D is invalid).

No community discussion yet for this question.