Every application in a company's portfolio has a separate AWS account for development and production. The security team wants to prevent the root user and all IAM users in the production accounts…

Question

Options

• ACreate a Service Control Policy that denies access to the services. Assemble all production
• BCreate a Service Control Policy that denies access to the services. Apply the policy to the root
• CCreate an IAM policy that denies access to the services. Associate the policy with an IAM group
• DCreate an IAM policy that denies access to the services. Create a Config Rule that checks that all

• A
  81% (42)
• B
  2% (1)
• C
  6% (3)
• D
  12% (6)

Explanation

As an administrator of the master account of an organization, you can restrict which AWS services and individual API actions the users and roles in each member account can access. This restriction even overrides the administrators of member accounts in the organization. When AWS Organizations blocks access to a service or API action for a member account a user or role in that account can't access any prohibited service or API action, even if an administrator of a member account explicitly grants such permissions in an IAM policy. Organization permissions overrule account permissions. Option B is invalid because service policies cannot be assigned to the root account at the account Option C and D are invalid because IAM policies alone at the account level would not be able to suffice the requirement

No community discussion yet for this question.