SOA-C02 · Question #689
A company has its accounts in an organization in AWS Organizations. The company deploys its first service control policy (SCP) to an organizational unit (OU). The SCP denies the iam:CreateUser…
The correct answer is C. Update the SCP to include an additional statement that allows the ec2:Runinstances action. An SCP acts as a filter on top of IAM policies – only actions that are both allowed in the identity policy and permitted by the SCP can be performed. Because the newly attached SCP only explicitly denies iam:CreateUser and does not expressly allow EC2-related calls, the SCP’s…
Question
A company has its accounts in an organization in AWS Organizations. The company deploys its first service control policy (SCP) to an organizational unit (OU). The SCP denies the iam:CreateUser action. Only the newly created SCP is attached to the OU. After deployment of the SCP, users in the OU who assume a developer IAM role can no longer launch Amazon EC2 instances. Which action should a SysOps administrator take to resolve this issue?
Options
- AAdd a permissions boundary to the developer IAM role to explicitly allow the ec2:RunInstances
- BUpdate the SCP to include an additional statement that allows all actions on all resources.
- CUpdate the SCP to include an additional statement that allows the ec2:Runinstances action.
- DUpdate the SCP by changing the denied iam:CreateUser action to iam:Create*.
How the community answered
(13 responses)- B8% (1)
- C77% (10)
- D15% (2)
Explanation
An SCP acts as a filter on top of IAM policies – only actions that are both allowed in the identity policy and permitted by the SCP can be performed. Because the newly attached SCP only explicitly denies iam:CreateUser and does not expressly allow EC2-related calls, the SCP’s default behavior blocks all other actions. By adding an explicit "Allow": "ec2:RunInstances" statement to the SCP, you ensure that the developer role can launch instances again while still preventing IAM user creation.
Topics
Community Discussion
No community discussion yet for this question.