Question

A company uses AWS Organizations with all features enabled. The compliance team requires that member accounts in the 'Production' OU can only create and manage resources in the eu-west-1 and eu-central-1 Regions, regardless of any IAM permissions granted within those accounts. Global services such as IAM and CloudFront must remain functional. What is the MOST effective way to enforce this restriction?

Accepted Answer

Attach a Service Control Policy (SCP) to the Production OU that denies all actions when the aws:RequestedRegion is not eu-west-1 or eu-central-1, with a NotAction condition excluding global services like IAM and CloudFront.

Answer

Create an IAM permission boundary in each member account limiting users to the two approved Regions.

Answer

Configure an IAM policy attached to every IAM group in the member accounts that allows only eu-west-1 and eu-central-1.

Answer

Enable AWS Config with a managed rule that flags resources created outside the approved Regions and auto-deletes them.