hard20 pts · first answer countsiamcloud-governance

Policy evaluation with SCPs

An IAM user has AdministratorAccess. Their AWS account is in an organization unit whose Service Control Policy denies ec2:RunInstances outside ap-south-1. The user tries to launch an instance in us-east-1. What happens?

A.The launch succeeds because AdministratorAccess allows all actionsB.The launch is denied because an explicit deny in the SCP overrides any allowC.The launch succeeds only if the user has MFA enabledD.The launch succeeds because SCPs only apply to the management account

Discussion 0

Join free to post in the discussion.

Policy evaluation with SCPs

Discussion 0

Related questions