CloudGuild · Blog · Cheat sheets · Lessons · Certifications
Understanding AWS Service Control Policies for Account Management
Learn how to effectively use Service Control Policies to restrict AWS Region access for accounts in your organization.
An organization wants to centrally prevent all member accounts from using AWS Regions outside of us-east-1 and us-west-2, regardless of individual IAM permissions. What should be used?
The question
- An IAM policy attached to each user
- A Service Control Policy (SCP) in AWS Organizations
- A security group rule
- A NACL on each VPC
Think before you scroll
This question tests your understanding of how to enforce region restrictions at an organizational level, not just at the individual user level. Consider the tools available in AWS Organizations versus IAM policies.
The answer
The correct option is B: A Service Control Policy (SCP) in AWS Organizations. SCPs set the maximum permissions for accounts within an organization. They can explicitly deny access to specific AWS Regions, effectively overriding any IAM permissions that would allow access.
Why the other options lose
- A: An IAM policy attached to each user: IAM policies are user-specific and do not apply across the entire organization. They can't enforce restrictions at a regional level for all users simultaneously.
- C: A security group rule: Security groups control inbound and outbound traffic for instances, not regional access. They do not restrict access to specific AWS Regions.
- D: A NACL on each VPC: Network Access Control Lists (NACLs) control traffic to and from subnets within a VPC. They do not govern access to AWS services or Regions, making them irrelevant to this requirement.
The concept behind it
Understanding Service Control Policies is crucial for managing permissions across multiple AWS accounts. SCPs allow organizations to enforce governance and compliance by setting boundary permissions that all member accounts must adhere to.
Exam trap to remember
Remember: Service Control Policies are your go-to tool for organization-wide restrictions, especially when you need to enforce rules that override IAM permissions.