SAP-C02 Q541 · Multi-Account

Question

A company uses AWS Organizations AWS account. A solutions architect must design a solution in which only administrator roles are allowed to use IAM actions. However the solutions archited does not have access to all the AWS account throughout the company. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

**Option C: Create an SCP that denies IAM actions for all users except administrator roles, applied to the root OU.**

This is correct for several critical reasons:

1. **Deny with Exception Strategy (Deny List)**: The SCP uses an explicit **Deny** with a `Condition` that excludes administrator roles (using `StringNotLike` or `ArnNotLike` on `aws:PrincipalArn`). This is the correct SCP pattern because SCPs act as permission guardrails — a Deny in an SCP **cannot be overridden** by any IAM policy in the member account.

2. **Root OU Application**: Applying the SCP to the root OU ensures it cascades to **every account** in the organization automatically, including any future accounts. The solutions architect doesn't need access to individual accounts.

3. **No Per-Account Access Required**:

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

🔒 Security

🎯 Exam Tips