SAP-C02 Q286 · Multi-Account

Question

A company manages hundreds of AWS accounts centrally in an organization in AWS Organizations. The company recently started to allow product teams to create and manage their own S3 access points in their accounts. The S3 access points can be accessed only within VPCs, not on the internet. What is the MOST operationally efficient way to enforce this requirement?

Accepted Answer

**Option B: Create an SCP at the root level to deny s3:CreateAccessPoint unless s3:AccessPointNetworkOrigin evaluates to VPC.**

Let's break down each requirement:

1. **Hundreds of AWS accounts**: SCPs (Service Control Policies) in AWS Organizations apply across all member accounts from a single policy definition. One SCP at the root level automatically covers every account in the organization — current and future.

2. **Product teams create their own access points**: Teams have autonomy, but the organization needs a guardrail. SCPs are perfect for this — they don't grant permissions, they set maximum permission boundaries. Teams can still manage their own IAM policies and S3 configurations freely, but they cannot violate the SCP.

3. **Access points must be VPC-only**: The `s3:AccessPoin

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

🔒 Security

🎯 Exam Tips