SAA-C03 Q333 · Multi-Account

Question

A company has separate AWS accounts for its finance, data analytics, and development departments. Because of costs and security concerns, the company wants to control which services each AWS account can use. Which solution will meet these requirements with the LEAST operational overhead?

Accepted Answer

**Option B: Create OUs for each department in AWS Organizations and attach SCPs to the OUs.**

This is the correct answer because it directly addresses both requirements:

1. **Control which services each account can use**: SCPs (Service Control Policies) are designed specifically for this purpose. They define the **maximum available permissions** for member accounts. If an SCP denies a service, no IAM policy in that account can override it — not even the root user.

2. **Least operational overhead**: 
   - OUs provide a logical grouping (Finance OU, Data Analytics OU, Development OU)
   - SCPs are attached once at the OU level and automatically apply to all accounts within that OU
   - Adding a new account to an OU automatically inherits the SCP — no manual per-account configuration neede

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

💰 Cost

🔒 Security

🎯 Exam Tips