Prevent EC2 Instance Launches with Least Overhead

SAA-C03 By islever Editorial Last updated

Design secure access to AWS resources.

Short answer

D Create an organization in AWS Organizations and apply a Service Control Policy (SCP) that denies the launch of large EC2 instances to all accounts.

Question

A development team uses multiple AWS accounts for its development, staging, and production environments. Team members have been launching large Amazon EC2 instances that are underutilized. A solutions architect must prevent large instances from being launched in all accounts. How can the solutions architect meet this requirement with the LEAST operational overhead?
  1. Update the IAM policies to deny the launch of large EC2 instances. Apply the policies to all users.
  2. Define a resource in AWS Resource Access Manager that prevents the launch of large EC2 instances.
  3. Create an IAM role in each account that denies the launch of large EC2 instances. Grant the developers IAM group access to the role.
  4. Create an organization in AWS Organizations in the management account with the default policy. Create a service control policy (SCP) that denies the launch of large EC2 instances, and apply it to the AWS accounts. Correct Answer

Key Takeaways

The core concept is using SCPs for centralized governance; the common trap is choosing per-account IAM policies which fail the 'least operational overhead' requirement due to maintenance burden.

This question tests how to centrally restrict AWS service actions across multiple accounts using AWS Organizations. The correct approach leverages Service Control Policies (SCPs) to enforce organization-wide security boundaries with minimal operational overhead.

Common mistake: Option A is the most frequent wrong answer because it correctly denies the action but ignores the scalability constraint. Maintaining identical deny statements in every individual account's IAM policies creates significant operational overhead compared to a single organizational policy.

Expert Analysis

Why the Answer Is Correct

Service Control Policies (SCPs) are managed by AWS Organizations and apply to all accounts within an organization (or specific OUs). By creating a single SCP that denies specific EC2 instance types (e.g., limiting vCPU or memory thresholds), the administrator ensures consistent enforcement across all member accounts without modifying individual IAM permissions. This directly satisfies the requirement for the least operational overhead.

Why the Other Options Are Wrong

Option A requires manually updating IAM policies in every single account, which scales poorly and increases error risk. Option B is incorrect because AWS Resource Access Manager (RAM) is designed for sharing resources like subnets or License Manager configurations, not for restricting API calls or launching instances. Option C involves creating roles in each account, which still requires per-account management and does not centrally prevent launches as effectively as an SCP boundary.

Community Comment Notes

Community consensus strongly supports D. One commenter noted that RAM is primarily for resource sharing, clarifying its scope. Another highlighted that while IAM can deny actions, the maintenance of separate policies across accounts violates the efficiency principle. As one user paraphrased, "You would need to update and maintain separate IAM policies in each account, which is too much trouble," reinforcing why A is inferior.

Official Reference

https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

When you see 'multiple accounts' and 'least operational overhead', immediately think AWS Organizations and SCPs. If the question asked for permission changes for a single user, IAM would be the choice, but cross-account governance defaults to SCPs.

Frequently Asked Questions

Why not use IAM Deny statements in each account?

IAM policies must be maintained individually in each account. With many accounts, this creates high operational overhead compared to a single SCP applied at the organization level.

Can AWS RAM restrict EC2 launches?

No. AWS Resource Access Manager (RAM) is used for sharing resources like VPC subnets or RDS instances between accounts, not for controlling API permissions or preventing resource creation.

More SAA-C03 FAQ →

Community Votes

D
100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. Hkayne 👍 6 Answered D
    https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html
  2. example_ 👍 3 Answered D
    https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps_examples.html
  3. 744fdad 👍 2
    why is it not A? If the goal is only to prevent launch of EC2s
  4. LeonSauveterre 👍 1 Answered D
    A - You would need to update and maintain separate IAM policies in each account, which is too much trouble. B - AWS Resource Access Manager (RAM) is primarily for resource sharing and does not directly restrict resource launches. C - IAM roles are better suited for granting access rather than imposing restrictions. You would also need to create and maintain these roles in every account, even more trouble than option A. D - SCPs are powerful here because they apply at the root account level, meaning that even if a developer has direct IAM permissions to launch large instances, the SCP will override and prevent it. Also, there's no need to create or manage multiple IAM policies or roles across accounts. Once the SCP is defined and applied, it enforces the restriction automatically.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide