SOA-C02 · Question #725
A company deploys an application to multiple AWS Regions. The company uses an organization in AWS Organizations to manage multiple AWS accounts. The company must prevent all AWS accounts from launchin
The correct answer is B. Create a service control policy (SCP) that denies actions in all Regions except the allowed Region.. An SCP from the management account can deny all actions in every Region except the allowed one, enforcing the restriction across every account regardless of local IAM policies or root users - minimal ongoing ops effort.
Question
A company deploys an application to multiple AWS Regions. The company uses an organization in AWS Organizations to manage multiple AWS accounts. The company must prevent all AWS accounts from launching AWS resources or accessing AWS services except in one allowed Region. Which solution will meet these requirements in the MOST operationally efficient way?
Options
- ACreate an AWS CloudFormation template that has a permissions boundary that allows only a
- BCreate a service control policy (SCP) that denies actions in all Regions except the allowed Region.
- CEdit AWS Identity and Access Management (IAM) settings for every AWS account to disable AWS
- DCreate IAM policies that include the aws:RequestedRegion condition to allow a specific Region.
How the community answered
(51 responses)- A4% (2)
- B73% (37)
- C16% (8)
- D8% (4)
Explanation
An SCP from the management account can deny all actions in every Region except the allowed one, enforcing the restriction across every account regardless of local IAM policies or root users - minimal ongoing ops effort.
Topics
Community Discussion
No community discussion yet for this question.