SAP-C02 Q57 · IAM

Question

A company with several AWS accounts is using AWS Organizations and service control policies (SCPs). An administrator created the following SCP and has attached it to an organizational unit (OU) that contains AWS account 1111-1111-1111: Developers working in account 1111-1111-1111 complain that they cannot create Amazon S3 buckets. How should the administrator address this problem?

Accepted Answer

**Answer C is correct** because SCPs do NOT grant permissions — they only define the **maximum boundary** (guardrails) of what actions are allowed in an account.

**Key principle:** For a user to perform an action in AWS, **both** of these must be true:
1. An **SCP** must **allow** the action (or at least not deny it)
2. An **IAM policy** attached to the user/role must **grant** the action

The SCP in question likely contains an Allow list that includes S3 actions (or doesn't explicitly deny them). However, even if the SCP allows `s3:CreateBucket`, the developers still need an **IAM policy** that explicitly grants `s3:CreateBucket` permission.

The developers cannot create S3 buckets because their **IAM entities (users/roles) lack the necessary S3 permissions**. The SCP is functioning cor

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

🔒 Security

🎯 Exam Tips