AWS Certified Security - Specialty SCS-C02 — Topic 1 Question 104

Question

A company has an organization with SCPs in AWS Organizations. The root SCP for the organization is as follows: The company's developers are members of a group that has an IAM policy that allows access to Amazon Simple Email Service (Amazon SES) by allowing ses:* actions. The account is a child to an OU that has an SCP that allows Amazon SES. The developers are receiving a not-authorized error when they try to access Amazon SES through the AWS Management Console. Which change must a security engineer implement so that the developers can access Amazon SES?

Accepted Answer

Correct answer: D. The correct answer is D. Option D: Remove Amazon SES from the root SCP. Service Control Policies set guardrails on what accounts in an organization can do.

AWS Certified Security - Specialty SCS-C02 — Question 104