Question
A company is using AWS Organizations with the default SCP. The company needs to restrict AWS usage for all AWS accounts that are in a specific OU.
Except for some desired global services, the AWS usage must occur only in the eu-west-1 Region for all accounts in the OU. A security engineer must create an SCP that applies the restriction to existing accounts and any new accounts in the OU.
Which SCP will meet these requirements?
- A. {"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"*","Resource":"*","Condition":{"StringNotEquals":{"aws:RequestedRegion":"eu-west-1"}},"Sid":"EnforceEUWest1Region"},{"Effect":"Allow","Action":"*","Resource":"*","Condition":{"ArnLike":{"aws:PrincipalArn":["arn:aws:iam::*:role/OrganizationAccountAccessRole"]}}}]}
- B. {"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"*","Resource":"*","Condition":{"StringNotEquals":{"aws:RequestedRegion":"eu-west-1"}}},{"Effect":"Allow","Action":"*","Resource":"*","Sid":"AllowGlobalServices"}]}
- C. {"Version":"2012-10-17","Statement":[{"Sid":"DenyAllOutsideEUWest1","Effect":"Deny","NotAction":["iam:*","organizations:*","sts:*","route53:*","cloudfront:*","globalaccelerator:*","waf:*","budgets:*","support:*","importexport:*"],"Resource":"*","Condition":{"StringNotEquals":{"aws:RequestedRegion":["eu-west-1"]}}}]} Correct
- D. {"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"*","Resource":"*","Condition":{"StringNotEquals":{"aws:RequestedRegion":"eu-west-1"}}},{"Effect":"Allow","Action":"*","Resource":"arn:aws:s3:::*","Sid":"AllowS3Access"}]}
Explanation
Option C is correct. It uses a single Deny statement with NotAction that lists the global services (such as IAM, AWS Organizations, AWS STS, Route 53, CloudFront and AWS Support) and a StringNotEquals condition on aws:RequestedRegion for eu-west-1. Every request to any other Region is denied, except requests to the listed global services, which are served from a single global endpoint outside eu-west-1 (for most of them in us-east-1) and would otherwise be blocked. The SCP only restricts; the default FullAWSAccess SCP still allows everything that is not denied, and because the SCP is attached to the OU it applies to the existing accounts and to any account moved into the OU later. Options A, B and D deny all actions outside eu-west-1 without exempting any service. Their Allow statements cannot override an explicit Deny, because an explicit Deny in an SCP always takes precedence, so global services would be blocked and the requirement to keep some global services available is not met.
