A healthcare company has multiple AWS accounts in an organization in AWS Organizations. The company uses Amazon S3 buckets to store sensitive information of patients. The company needs to restrict use

The correct answer is D. SCPs. Service Control Policies (SCPs) are policies that can be applied at the organization or organizational unit (OU) level within AWS Organizations. They allow the organization to enforce central control over the maximum available permissions for all accounts within the organization.

Submitted by joshua94· Mar 6, 2026Management and Security Governance

Question

A healthcare company has multiple AWS accounts in an organization in AWS Organizations. The company uses Amazon S3 buckets to store sensitive information of patients. The company needs to restrict users from deleting any S3 bucket across the organization. What is the MOST scalable solution that meets these requirements?

Options

APermissions boundaries in AWS Identity and Access Management (IAM)
BS3 bucket policies
CTag policies
DSCPs

How the community answered

(42 responses)

A
5% (2)
B
5% (2)
C
14% (6)
D
76% (32)

Explanation

Service Control Policies (SCPs) are policies that can be applied at the organization or organizational unit (OU) level within AWS Organizations. They allow the organization to enforce central control over the maximum available permissions for all accounts within the organization. SCPs can be used to explicitly deny actions such as deleting S3 buckets across all accounts, regardless of the IAM policies within individual accounts. This approach is scalable because it applies across the entire organization, ensuring that no users or roles in any account can delete S3 buckets if the SCP denies that action.

Topics

#SCPs#AWS Organizations#S3 bucket policies#permissions boundaries

Community Discussion

No community discussion yet for this question.

Full SCS-C02 Practice