SCS-C03 · Question #14
A company uses AWS Organizations to manage an organization that consists of three workload OUs: Production, Development, and Testing. The company uses AWS CloudFormation templates to define and…
The correct answer is A. Review the AWS CloudTrail logs in the account in the Production OU. Search for any failed API. Explanation Option A is correct because CloudTrail logs provide the exact API calls that failed, including the specific action, resource, and the deny reason - this gives the security engineer precise, actionable information to identify which SCP or permission boundary is…
Question
A company uses AWS Organizations to manage an organization that consists of three workload OUs: Production, Development, and Testing. The company uses AWS CloudFormation templates to define and deploy workload infrastructure in AWS accounts that are associated with the OUs. Different SCPs are attached to each workload OU. The company successfully deployed a CloudFormation stack update to workloads in the Development OU and the Testing OU. When the company uses the same CloudFormation template to deploy the stack update in an account in the Production OU, the update fails. The error message reports insufficient IAM permissions. What is the FIRST step that a security engineer should take to troubleshoot this issue?
Options
- AReview the AWS CloudTrail logs in the account in the Production OU. Search for any failed API
- BRemove all the SCPs that are attached to the Production OU. Rerun the CloudFormation stack
- CConfirm that the role used by CloudFormation has sufficient permissions to create, update, and
- DMake all the SCPs that are attached to the Production OU the same as the SCPs that are
How the community answered
(37 responses)- A73% (27)
- B16% (6)
- C8% (3)
- D3% (1)
Explanation
Explanation
Option A is correct because CloudTrail logs provide the exact API calls that failed, including the specific action, resource, and the deny reason - this gives the security engineer precise, actionable information to identify which SCP or permission boundary is blocking the CloudFormation deployment, without making any disruptive changes to the environment first.
Why the distractors are wrong:
- Option B is incorrect because removing all SCPs from Production is a drastic, potentially dangerous action that violates the principle of least privilege and should never be a first troubleshooting step in a production environment.
- Option C is incorrect because while verifying IAM role permissions is a valid step, the clue in the scenario is that the same template worked in other OUs - pointing to an SCP difference rather than a missing IAM permission on the role itself.
- Option D is incorrect because making Production SCPs identical to other OUs bypasses the investigation entirely and may remove intentional, required security controls on the Production environment.
Memory Tip
Think "Investigate Before You Operate" - in security troubleshooting, always read logs first before modifying permissions or policies. CloudTrail is your first stop for any IAM-related failure because it tells you exactly what was denied and why.
Topics
Community Discussion
No community discussion yet for this question.