Question

A company uses AWS Organizations with all features enabled. To meet data residency requirements, the security team must ensure that developers in a specific organizational unit (OU) can only create resources in the eu-west-1 and eu-central-1 Regions. Global services like IAM must continue to work. Which approach enforces this restriction most effectively across all accounts in the OU?

Accepted Answer

Attach a Service Control Policy (SCP) to the OU that denies all actions when the aws:RequestedRegion condition key is not one of the approved Regions, with a NotAction exception for global services.

Answer

Create an IAM permissions boundary in each account that limits developers to the two approved Regions and attach it to every IAM user.

Answer

Configure an AWS Config rule in each account that flags resources created outside the approved Regions and triggers automatic deletion.

Answer

Use IAM Access Analyzer to detect and block resource creation attempts in unapproved Regions across the OU.