A company manages hundreds of AWS accounts centrally in an organization in AWS Organizations. The company recently started to allow product teams to create and manage their own S3 access points in their accounts. The S3 access points can be accessed only within VPCs, not on the internet. What is the MOST operationally efficient way to enforce this requirement?

Question

Accepted Answer

B. Create an SCP at the root level in the organization to deny the s3:CreateAccessPoint action

Answer

A. Set the S3 access point resource policy to deny the s3:CreateAccessPoint action unless the

Answer

C. Use AWS CloudFormation StackSets to create a new IAM policy in each AWS account that

Answer

D. Set the S3 bucket policy to deny the s3:CreateAccessPoint action unless the

A company manages hundreds of AWS accounts centrally in an organization in AWS Organizations. The company recently started to allow product teams to create and manage their own S3 access points in…

Question

Options

How the community answered

Explanation

Community Discussion