A company manages many AWS accounts under AWS Organizations. The security team wants one guardrail, applied at the organizational unit level, that prevents every IAM principal in every member account under that OU from ever disabling AWS CloudTrail — even a principal that has full administrator permissions from a local identity-based policy. Which control should they use?
- An IAM permissions boundary applied individually to every administrator role in every member account
- A service control policy attached to the OU that explicitly denies the CloudTrail-disabling actions for every principal in every account under it
- A resource-based policy attached directly to the CloudTrail trail
- An IAM group in the organization's management account that contains all administrators
Why B? And why not the others?
Correct answer: B. A service control policy attached to the OU that explicitly denies the CloudTrail-disabling actions for every principal in every account under it
A service control policy attached to an organizational unit sets a permissions ceiling for every account under it and applies to every IAM principal in those accounts, including administrators and, by default, even the account's root user; an explicit Deny in an SCP on the CloudTrail-disabling actions cannot be overridden by any local identity-based policy, which is exactly the org-wide guarantee described. The option using a permissions boundary is wrong because a boundary must be attached to each individual role or user one at a time within a single account, so it cannot provide a single OU-wide guarantee and is easy to miss for a newly created role. The option using a resource-based policy on the trail is wrong because AWS CloudTrail trails do not support attaching resource-based policies to control who may stop or start logging in this way. The option using an IAM group is wrong because IAM groups only exist within a single account and only affect the IAM users placed in them; they cannot restrict administrators across every account in an OU, nor do they restrict roles at all.
Source: AWS Organizations documentation: Service control policies (SCPs)