SAA-C03 Practice Question 12: SCP Region Restriction
AWS Certified Solutions Architect – Associate (SAA-C03) · Test 2 · question 2 of 10
A company runs 40 member accounts in AWS Organizations. A new data residency mandate says that nobody in those accounts may create or use resources outside eu-central-1 and eu-west-1. This includes account administrators who hold the AdministratorAccess policy. Global services such as IAM, CloudFront, and Route 53 must keep working.
The control must prevent violations, not just report them after the fact. What should the architect implement?
Show answer and explanation
Answer:
A service control policy is a permission guardrail that applies to every IAM user and role in the member accounts it is attached to. Administrators in those accounts cannot edit or detach it, because it is managed from the organization. A Deny statement conditioned on aws:RequestedRegion with StringNotEquals blocks every call to a Region outside the approved list. The NotAction element exempts global services like IAM, CloudFront, Route 53, and Support. Their requests are served from us-east-1, so without the exemption they would be denied too. Attaching the SCP to the OU covers all 40 accounts, and any accounts added later, in one place. Note that SCPs never grant permissions, and they do not affect the management account.
Option A uses the right deny logic in the wrong place. Permissions boundaries are set per principal, so a local administrator with IAM rights could create a new role without one. You would also have to attach the boundary to every principal in 40 accounts, forever.
Option B is a detective control. AWS Config reports the non-compliant resource after it already exists, which the mandate explicitly rejects.
Option C fails for the same reason as A. An identity policy lives inside the account it governs, so anyone holding AdministratorAccess can detach it or edit it.
References: Service control policies (SCPs); AWS: Denies access to AWS based on the requested Region