CLF-C02 Practice Question 36: Restrict Regions Organization
AWS Certified Cloud Practitioner (CLF-C02) · Test 4 · question 6 of 10
A company runs 40 member accounts in AWS Organizations. Regulations require that no resources are ever created outside two approved European Regions. The control must also apply to administrators in member accounts who have the AdministratorAccess policy, and to the root user of each member account. What should the company do?
Show answer and explanation
Answer:
A service control policy (SCP) sets the maximum available permissions for IAM users and roles in the member accounts it is attached to, including each member account's root user. If an SCP blocks an action, nobody in the affected account can use it, even if an administrator has an IAM policy granting * on *. That makes it an organization-wide guardrail that account administrators cannot bypass. Two limits are worth knowing: SCPs never *grant* permissions, and they have no effect on the management account.
Option A fails on both conditions in the stem. IAM policies do not restrict the root user, and an administrator with AdministratorAccess can simply detach the policy or act outside the group. Option B *detects* resources after they have been created; AWS Config evaluates and reports compliance but does not prevent the action. Option C only affects people who sign in through IAM Identity Center. It does nothing about IAM users created locally in an account or about the root user.
Reference: Service control policies (SCPs)