SAA-C03 Q662 · IAM

Question

A global company operates in multiple AWS Regions to meet data residency requirements. The company uses AWS Organizations to manage its accounts. The company wants to restrict IAM roles and access to specific Regions to prevent accidental data operations across geographic boundaries. Which solution will meet these requirements?

Accepted Answer

**Option B: Configure IAM policies using the `aws:RequestedRegion` condition** is correct because:

1. **Exact requirement match**: The question asks to restrict IAM roles and access to specific Regions. The `aws:RequestedRegion` global condition key is purpose-built for this — it evaluates the AWS Region that the API call targets.

2. **Broad coverage**: Unlike Option A which only covers `ec2:RunInstances`, an IAM policy with `aws:RequestedRegion` can restrict ALL service actions in non-compliant Regions. A single deny policy can prevent any data operations across geographic boundaries.

3. **Example policy pattern**:
```json
{
  "Effect": "Deny",
  "Action": "*",
  "Resource": "*",
  "Condition": {
    "StringNotEquals": {
      "aws:RequestedRegion": ["eu-west-1", "eu-central-1"]
    }

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

🔒 Security

🎯 Exam Tips