Several data accounts must prohibit dangerous operations such as disabling CloudTrail or deleting KMS keys.
Local administrators must not bypass the prohibited scope by changing IAM policies.
Which authorization approach is most appropriate?
Apply an AWS Organizations SCP to the OU or accounts as a maximum-permission guardrail and design controlled exceptions.
Detailed explanation
Names are not authorization rules.
Names are not authorization rules.
Broad grants do not prevent dangerous operations.
Broad grants do not prevent dangerous operations.
Audit cleanup does not prevent execution.
Audit cleanup does not prevent execution.
An SCP can deny the prohibited scope even when an account IAM policy changes.
An SCP can deny the prohibited scope even when an account IAM policy changes.
Check official documentation
Compare the following points with the official documentation.
AWS Organizations service control policies、IAM policy evaluation、organizational unitsの公式説明を確認する。
What to confirm
SCPが権限を付与するのではなく、アカウント内の最大許可範囲を制限することを説明できる。
Key points
- SCP
- Organizations
- Guardrail
- Maximum permission
Notes
- Environment: AWS公式DEA-C01試験ガイドと各サービスの公式ドキュメントの確認
- Confirm current AWS service behavior in the official DEA-C01 documentation.
Foundation review
Boundary design
Define OU-specific denies and isolate management or break-glass exceptions.
Verification
Test valid operations and denied operations before and after applying the SCP.