Question

A security engineer must enforce that all member accounts in an AWS Organization can only operate in the eu-west-1 and eu-central-1 Regions to meet data residency requirements. However, the organization still relies on global services such as IAM, AWS Organizations, Route 53, and CloudFront, which make API calls that appear to originate from us-east-1. The engineer applies a Service Control Policy (SCP) that denies all actions when aws:RequestedRegion is not one of the two approved Regions. After deployment, users report they can no longer create IAM users or manage Route 53 hosted zones. What is the BEST way to fix the SCP while still enforcing the Regional restriction?

Accepted Answer

Add a NotAction element to the Deny statement that lists the global service actions (e.g., iam:*, route53:*, cloudfront:*, organizations:*, support:*) so those actions are excluded from the Regional deny.

Answer

Change the SCP from a Deny statement to an Allow statement that lists only the two approved Regions in the Condition.

Answer

Add us-east-1 to the list of allowed Regions in the aws:RequestedRegion condition so global service calls succeed.

Answer

Attach an IAM permissions boundary to each user granting access to the global services in addition to the SCP.