AWS Certified Solutions Architect - Professional SAP-C02 — Topic 1 Question 286

Question

A company manages hundreds of AWS accounts centrally in an organization in AWS Organizations. The company recently started to allow product teams to create and manage their own S3 access points in their accounts. The S3 access points can be accessed only within VPCs, not on the internet. What is the MOST operationally efficient way to enforce this requirement?

Accepted Answer

Correct answer: B. The correct answer is B. Option B: Create an SCP at the root level in the organization to deny the s3:CreateAccessPoint action unless the s3:AccessPointNetworkOrigin condition key evaluates to VPC. Amazon S3 provides durable, scalable object storage that is fully managed. Service Control Policies set guardrails on what accounts in an organization can do.

AWS Certified Solutions Architect - Professional SAP-C02 — Question 286