A company with several AWS accounts is using AWS Organizations and service control policies (SCPs). An Administrator created the following SCP and has attached it to an organizational unit (OU) that…

Question

Options

• AAdd s3:CreateBucket with Allow effect to the SCP.
• BRemove the account from the OU, and attach the SCP directly to account 1111-1111-1111.
• CInstruct the Developers to add Amazon S3 permissions to their IAM entities.
• DRemove the SCP from account 1111-1111-1111.

• A
  3% (1)
• B
  11% (4)
• C
  83% (30)
• D
  3% (1)

Explanation

https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html "SCPs are similar to AWS Identity and Access Management (IAM) permission policies and use almost the same syntax. However, an SCP never grants permissions." SCPs alone are not sufficient to granting permissions to the accounts in your organization. No permissions are granted by an SCP. An SCP defines a guardrail, or sets limits, on the actions that the account's administrator can delegate to the IAM users and roles in the affected accounts. The administrator must still attach identity-based or resource-based policies to IAM users or roles, or to the resources in your accounts to actually grant permissions. The effective permissions are the logical intersection between what is allowed by the SCP and what is allowed by the IAM and resource-based policies.

No community discussion yet for this question.