AWS SCP Deployment for Selective Account Restrictions

SAA-C03 By islever Editorial Last updated

Design secure access to AWS resources.

Short answer

BE Deploy the SCP directly to the nonproduction member accounts or group them into a dedicated OU and attach the policy there.

Question

A company has an organization in AWS Organizations. The company runs Amazon EC2 instances across four AWS accounts in the root organizational unit (OU). There are three nonproduction accounts and one production account. The company wants to prohibit users from launching EC2 instances of a certain size in the nonproduction accounts. The company has created a service control policy (SCP) to deny access to launch instances that use the prohibited types. Which solutions to deploy the SCP will meet these requirements? (Choose two.)
  1. Attach the SCP to the root OU for the organization.
  2. Attach the SCP to the three nonproduction Organizations member accounts. Correct Answer
  3. Attach the SCP to the Organizations management account.
  4. Create an OU for the production account. Attach the SCP to the OU. Move the production member account into the new OU.
  5. Create an OU for the required accounts. Attach the SCP to the OU. Move the nonproduction member accounts into the new OU. Correct Answer

Key Takeaways

The question tests the understanding of SCP inheritance and scope, specifically that attaching a policy to the root affects all accounts, requiring targeted attachment to member accounts or specific OUs.

This page explains how to correctly deploy an AWS Service Control Policy (SCP) to restrict EC2 instance types in specific nonproduction accounts while leaving the production account unaffected.

Common mistake: Many candidates incorrectly choose option A, failing to realize that attaching the SCP to the root OU would inadvertently block the production account as well.

Expert Analysis

Why the Answer Is Correct

To meet the requirement of prohibiting EC2 launches only in nonproduction accounts, we must target those specific accounts without affecting the production account. Option B is correct because directly attaching the SCP to the three nonproduction member accounts applies the restriction solely to them. Option E is also correct because creating a dedicated OU for these accounts and attaching the SCP to that OU achieves the same scoped effect through organizational hierarchy.

Why the Other Options Are Wrong

Option A is incorrect because attaching the SCP to the root OU applies it to every account in the organization, including the production account, violating the requirement to exclude it. Option C is incorrect because the management account is typically used for billing and organization management and does not run workloads like EC2 instances; furthermore, restricting it doesn't solve the problem for the other accounts. Option D is incorrect because it focuses on restricting the production account, which is the opposite of the goal.

Community Comment Notes

The community consensus strongly favors options B and E, with high upvotes confirming this logic. As noted by user MatAlves, "A would also affect the one production account, which we clearly don't want." This highlights the critical trap of assuming root-level application is acceptable when selective exclusion is required.

Official Reference

https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scp.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

Always map the 'who' and 'what' in the scenario first. If you need to exclude specific entities from a broad policy, avoid the Root. Target the specific leaves (accounts) or create a branch (OU) for the subset you want to manage.

Frequently Asked Questions

Can I attach an SCP to a single IAM role?

No, SCPs apply to Organizations roots, OUs, or member accounts. They do not apply to individual IAM roles or users.

Why is attaching to the Root OU wrong here?

Attaching to the Root applies the policy to ALL accounts in the organization, including the production account, which violates the exclusion requirement.

More SAA-C03 FAQ →

Community Votes

BE
100%

100% of anonymous learners picked answer BE. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 8 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 8

  1. mestule 👍 6
    I think it's B (directly attach) and E (attach via OU).
  2. sandordini 👍 4
    Only the non-prods need to be limited.
  3. Cali182 👍 2
    From Chat A. Attach the SCP to the root OU for the organization: Attaching the SCP to the root OU ensures that it applies to all member accounts within the organization, including both nonproduction and production accounts. D. Create an OU for the production account. Attach the SCP to the OU. Move the production member account into the new OU: By creating a separate OU for the production account and attaching the SCP to that OU, you can ensure that the SCP only affects the nonproduction accounts while allowing the production account to operate without restrictions.
  4. MatAlves 👍 2
    B - Attach the SPC to the three accounts E - Creates an OU > moves the member accounts to OU > attach the SCP to OU "If you apply an authorization policy (for example, a service control policy (SCP)), to the root, it applies to all organizational units (OUs) and member accounts in the organization." "A" would also affect the one production account, which we clearly don't want. You can "attach an SCP to a root, OU, or account"
  5. 67a3f49 👍 1
    According to GPT-4 it's AE: A. Attach the SCP to the root OU for the organization. This approach will apply the SCP to all accounts under the organization, including both nonproduction and production accounts. However, without additional context or actions, this does not meet the requirement to exclude the production account from the restrictions. E. Create an OU for the required accounts. Attach the SCP to the OU. Move the nonproduction member accounts into the new OU. This is the correct approach as it directly addresses the requirement. By creating a separate OU for nonproduction accounts and attaching the SCP to this OU, you can specifically target the policy to only those accounts, effectively exempting the production account from the restrictions.
Show 3 more comments
  1. 1Alpha1 👍 1
    AC - same answer https://docs.aws.amazon.com/organizations/latest/userguide/orgs_getting-started_concepts.html
  2. Andy_09 👍 1
    CE should be the correct answer
  3. anikolov 👍 12
    My vote is for BE

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide