AWS Certified Security - Specialty SCS-C02 — Topic 1 Question 263

Question

A company needs to prevent Amazon S3 objects from being shared with IAM identities outside of the company’s organization in AWS Organizations. A security engineer is creating and deploying an SCP to accomplish this goal. The company has enabled the S3 Block Public Access feature on all of its S3 buckets. What should the SCP do to meet these requirements?

Accepted Answer

Correct answer: A. The correct answer is A. Option A: Deny the S3:* action with a Condition element that comprises an operator of StringNotEquals, a key of aws:ResourceOrgID, and a value of S{aws PrincipalOrgID}. Amazon S3 provides durable, scalable object storage that is fully managed. The aws:PrincipalOrgID condition key restricts access to accounts within your AWS Organization with minimal effort.

AWS Certified Security - Specialty SCS-C02 — Question 263