SCP (service control policy) quiz · Level 0

Question 1An SCP on Todo.io's Prod OU allows s3:*. A role in Prod has no IAM policies that mention S3, and the bucket has no bucket policy. Can the role read objects from a bucket in Prod?

No. SCPs only set the most an account can do; something must still grant the permission.Correct. An SCP never grants anything. With no identity policy and no bucket policy allowing it, the request is implicitly denied.Yes. The SCP allows s3:* for every role in the OU.Not this one. SCPs are a ceiling, not a grant. An Allow in an SCP only means "IAM may allow this here".Yes, but only for buckets in the same Region as the role.Not this one. Roles are global and Regions have nothing to do with it. Nothing grants the permission, so the answer is no.Only if the role was created through Control Tower.Not this one. How the role was created doesn't matter. Permissions come from policies, not from the tool that made the role.

Learn it: SCP (service control policy) · IAM (Identity and Access Management) · Set up AWS: Day 0

Question 2Why does Todo.io keep its apps out of the management account of its organization?

SCPs never apply to the management account, so the organization's guardrails can't protect anything running there.Correct. The management account sits above every SCP. Keeping it empty, apart from billing and account management, means nothing important runs without guardrails.The management account can't create VPCs or databases.Not this one. It can create anything any account can. The problem is that nothing restricts it.Resources in the management account are billed twice.Not this one. Billing is consolidated once, at the organization level. Where a resource runs makes no difference to its price.The management account has no CloudTrail.Not this one. It has CloudTrail like every account. That isn't why it's kept empty.

Learn it: AWS Organizations · SCP (service control policy) · Set up AWS: Day 0

Question 3Todo.io's auditors require that nobody in the Prod account can ever stop CloudTrail logging. Which control meets the requirement?

An SCP on the Prod OU that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail.Correct. "Can ever" asks for a preventive control. An SCP Deny blocks the API call for everyone in the account, administrators and root included.An AWS Config rule that checks CloudTrail is turned on.Not this one. Config is detective: it tells you after logging was stopped. The requirement says it must never happen.A CloudWatch alarm that emails the security team when logging stops.Not this one. An alarm also fires after the fact. Being told isn't the same as preventing it.Remove cloudtrail:StopLogging from every IAM policy in the account.Not this one. Anyone who can edit IAM policies could add it back. An SCP sits outside the account, where they can't change it.

Learn it: SCP (service control policy) · Controls (guardrails) · Set up AWS: Day 0 with Control Tower

Question 4Todo.io attaches an SCP to its Workloads OU. The Prod and Dev accounts sit in that OU, and a Sandbox OU sits inside it. Which accounts does the SCP apply to?

Every account in the Workloads OU, including accounts in the Sandbox OU inside it.Correct. A policy on an OU is inherited by every account below it, however deep.Only accounts created after the SCP was attached.Not this one. Existing accounts are covered the moment the SCP is attached.Prod and Dev, but not the accounts in the Sandbox OU.Not this one. Nested OUs inherit their parent's policies.Only the IAM users in those accounts, not the roles.Not this one. SCPs apply to every user and role in a member account, root included.

Learn it: AWS Organizations · SCP

Question 5Todo.io wants to stop anyone, including the root user, from deleting the audit bucket in its Prod account. Prod is a member account. Can an SCP do that?

Yes. SCPs apply to the root user of a member account too.Correct. IAM policies can't limit root, but an SCP can, in member accounts.No. The root user ignores every policy.Not this one. Root ignores IAM policies, not SCPs. In a member account, an SCP Deny stops root too.Only if the root user has MFA turned on.Not this one. MFA protects how root signs in. It doesn't change what an SCP allows.Only if Prod is the management account.Not this one. The opposite: SCPs never apply to the management account.

Learn it: SCP (service control policy) · Root user

Question 6An SCP on the Prod OU denies a set of RDS actions. Which of these does the SCP NOT restrict?

Service-linked roles, such as the one RDS uses to manage its own network interfaces.Correct. SCPs never apply to service-linked roles, so AWS services can keep running what they manage for you.IAM users in the Prod account.Not this one. SCPs apply to every IAM user in a member account.IAM roles in the Prod account.Not this one. SCPs apply to every IAM role in a member account, except service-linked roles.The root user of the Prod account.Not this one. SCPs apply to root in member accounts.

Learn it: SCP (service control policy) · Service-linked role

Question 7Todo.io may only run in us-east-1 and eu-west-1, in every account, now and in future accounts. What enforces that?

An SCP attached to the organization's root, at the top of the tree, that denies requests outside those two Regions.Correct. A preventive guardrail at the top of the tree covers every member account, including ones created later. (As always, SCPs skip the management account.) Global services such as IAM are left out of a Region rule.An IAM policy on every user and role that only allows those Regions.Not this one. Anyone who can edit IAM policies can remove it, and every new user or role needs it added.An AWS Config rule that flags resources in other Regions.Not this one. Config reports after the fact. The requirement says it may only run there.Deleting the default VPC in every other Region.Not this one. Many services don't need a VPC at all, and anyone can create a new VPC.

Learn it: SCP (service control policy) · Controls (guardrails) · Region

Question 8Todo.io wants every production account, including ones it adds next year, to get the same guardrails automatically. What should it do?

Group the production accounts in a Prod OU and attach the guardrails (SCPs) to the OU.Correct. An OU is a folder of accounts. Move a new account into it and it inherits everything attached there.Attach the SCPs to each production account one by one.Not this one. It works today, but next year's accounts are only protected if someone remembers.Put the production accounts in an IAM group.Not this one. IAM groups hold IAM users, not accounts.Tag each production account "prod".Not this one. Tags don't attach policies by themselves.

Learn it: AWS Organizations · SCP

Question 9In Todo.io's Prod account, a developer's role has an IAM policy that allows dynamodb:DeleteTable. An SCP attached to the Prod OU denies dynamodb:DeleteTable. The developer tries to delete a table. What happens?

The request is denied. An explicit Deny anywhere always wins.Correct. IAM checks every policy that applies. One explicit Deny, here in the SCP, overrides any number of Allows.The request is allowed, because the role's own policy is more specific than the SCP.Not this one. Specificity never matters in IAM. A Deny beats an Allow, wherever each one is written.The request is allowed, because SCPs only apply to the root user.Not this one. SCPs apply to every user and role in a member account, root included.The request is allowed, but AWS Config reports it afterwards.Not this one. Config is detective: it reports after the fact. This request never happens, because the SCP is preventive.

Learn it: IAM policy · SCP (service control policy) · Set up AWS: Wrong Region

Question 10What does "SCP (service control policy)" mean?

An organization-wide guardrail that sets the most any identity in an account may do.Correct. Think of it as: The building's rules. Your lease can't give you permission to break them.Groups many AWS accounts under one management account, with one bill and shared guardrails.Not this one. That describes AWS Organizations.One place for people to sign in and get access to many AWS accounts.Not this one. That describes IAM Identity Center.A second proof of identity, like a code from an app or a security key, on top of a password.Not this one. That describes MFA (multi-factor authentication).

Learn it: SCP (service control policy)

Question 11Which term is this? "An organization-wide guardrail that sets the most any identity in an account may do."

SCP (service control policy)Correct. Yes. Think of it as: The building's rules. Your lease can't give you permission to break them.AWS OrganizationsNot this one. AWS Organizations is: Groups many AWS accounts under one management account, with one bill and shared guardrails.IAM Identity CenterNot this one. IAM Identity Center is: One place for people to sign in and get access to many AWS accounts.MFA (multi-factor authentication)Not this one. MFA (multi-factor authentication) is: A second proof of identity, like a code from an app or a security key, on top of a password.

Learn it: SCP (service control policy)

Question 12Which AWS term is described by this analogy? "The building's rules. Your lease can't give you permission to break them."

SCP (service control policy)Correct. Yes: An organization-wide guardrail that sets the most any identity in an account may do.AWS OrganizationsNot this one. AWS Organizations is: Groups many AWS accounts under one management account, with one bill and shared guardrails. Its analogy: The building management company that owns every flat.IAM Identity CenterNot this one. IAM Identity Center is: One place for people to sign in and get access to many AWS accounts. Its analogy: The front desk that hands you a temporary key card for whichever flat you're cleared for.MFA (multi-factor authentication)Not this one. MFA (multi-factor authentication) is: A second proof of identity, like a code from an app or a security key, on top of a password. Its analogy: A PIN on top of the key card.

Learn it: SCP (service control policy)

SCP (service control policy)

Worth another look

Your weak spots

Services

Concepts