Question

A security engineer at a company using AWS Organizations must enforce that all member accounts can only operate in the eu-west-1 and eu-central-1 regions to meet data residency requirements. However, the finance team needs global services such as IAM, CloudFront, and Route 53 to continue functioning, and one designated account (the networking account) must additionally be allowed to use us-east-1 for a legacy Direct Connect gateway configuration. What is the MOST effective way to implement this using Service Control Policies (SCPs)?

Accepted Answer

Attach an SCP to the root that denies all actions when aws:RequestedRegion is not in the approved region list, using a NotAction element to exempt global services, and attach a separate less-restrictive SCP only to the networking account's OU that includes us-east-1.

Answer

Attach an SCP to each OU with an Allow statement listing only the eu-west-1 and eu-central-1 regions, relying on the implicit deny to block all other regions including global services.

Answer

Create an IAM permission boundary on every role in the member accounts that denies actions outside the approved regions, and add a condition exception for the networking account.

Answer

Attach a single SCP to the organization root that denies all actions when aws:RequestedRegion is not eu-west-1 or eu-central-1, and manually add us-east-1 to the same policy so the networking account can use it.