Question

A security engineer is designing the service control policy (SCP) strategy for a newly created AWS Organization with all features enabled. The compliance team requires that member accounts be permitted to use only Amazon S3, Amazon EC2, and AWS CloudTrail — every other AWS service must be blocked, and this restriction should apply even to new services AWS launches in the future. The engineer wants the simplest, most maintainable approach that will not require editing the policy each time AWS releases a new service. Which approach meets these requirements?

Accepted Answer

Detach the AWS-managed FullAWSAccess SCP from the target OU and attach a custom SCP that uses Allow statements listing only the s3, ec2, and cloudtrail service namespaces.

Answer

Keep the FullAWSAccess SCP attached and add a custom SCP with Deny statements enumerating every AWS service other than s3, ec2, and cloudtrail.

Answer

Attach a custom SCP with an Allow statement for s3, ec2, and cloudtrail while leaving FullAWSAccess attached so both policies are evaluated together.

Answer

Use an IAM permissions boundary applied to every role in the member accounts that allows only s3, ec2, and cloudtrail actions.