How Do You Restrict an AWS Organizations OU to a Single Region with an SCP?
A company is using AWS Organizations with the default SCP. The company needs to restrict AWS usage for all AWS accounts that are in a specific OU. Except for some desired global services, the AWS usage must occur only in the eu-west-1 Region for all accounts in the OU. A security engineer must create an SCP that applies the restriction to existing accounts and any new accounts in the OU. Which SCP will meet these requirements?
Community Insight
The test is whether you can write a deny-based region guardrail that also protects global services (IAM, STS, CloudFront, Route 53, Organizations, Support) — the trap is denying everything outside eu-west-1 without a NotAction carve-out, which breaks those global services.
AWS Organizations service control policies can confine every account in an OU to a single Region by denying actions whose aws:RequestedRegion is anything other than the approved Region, while carving out global services. This page confirms that the SCP built with a StringNotEquals region condition plus a NotAction exemption list is the one that satisfies the requirement for existing and future accounts.
Choosing a policy that keys on aws:RequestedRegion with a plain Allow or that omits the NotAction global-service exemption; a bare deny on region would also block IAM, STS, Route 53 and other global endpoints that never report a Region, breaking sign-in, DNS and billing across the OU.
Community Discussion (4 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
SCPs are deny-by-default guardrails that sit above IAM, so the only reliable way to force a Region boundary is a Deny statement with the condition StringNotEquals on aws:RequestedRegion set to eu-west-1 — everything that is not eu-west-1 gets denied. Because a Deny applies to all actions including the global ones, the correct policy pairs that condition with NotAction, listing the global services that must keep working (IAM, STS, Organizations, Route 53, CloudFront, Support, and similar). Attaching the SCP at the OU level makes it inherited by every member account, which covers the existing accounts and any account added to the OU later, exactly as the requirement demands. That structure is what option C represents, and the community reading matches it: as bigdata2ml put it, "deny all the services" only when the region is not the approved one.Why the Other Options Are Wrong
The other exhibits are the classic distractors for this scenario: policies that allow only eu-west-1 with no deny (so nothing is actually restricted, since SCPs already allow by default only within the account's IAM grants), policies that deny on aws:RequestedRegion without the NotAction exemption, and policies scoped too narrowly — for example attached with a condition on a single service or using Principal/Resource elements that SCPs do not evaluate. Any of these either fails to block non-eu-west-1 usage or breaks global services such as IAM and Route 53 for the whole OU. A policy missing the global-service carve-out is especially damaging because it silently blocks sign-in and DNS resolution, not just compute in the wrong Region.Community Comment Notes
Liongeek is blunt and confident — "Letter C for sure" — and bigdata2ml explains the mechanics of the StringNotEquals region condition combined with a NotAction list for the "few global services", which is the essential nuance. Another voter (7f6aef3) restates the same logic in Spanish: the policy denies everything when the region is not eu-west-1 and "permite solo eu-west-1 y protege los servicios globales" through NotAction. The consensus is therefore not a vote artifact — the commenters converge on the same deny-with-exemption pattern that the AWS documentation prescribes for Region-restriction guardrails.Official Reference
Exam Strategy
When a question says "except for some desired global services" and names a single Region, immediately look for the exhibit with Deny + StringNotEquals on aws:RequestedRegion + NotAction. Eliminate any option where the region condition sits under Allow or where the global services are not explicitly excluded, then confirm the policy is attached to the OU rather than a single account.
Frequently Asked Questions
Why does the SCP need NotAction for global services in the eu-west-1 restriction?
Global services such as IAM, STS, Route 53 and CloudFront do not report a Region, so a plain region deny would block them and break sign-in and DNS for every account in the OU.
Why is an SCP that only allows eu-west-1 wrong for this OU?
SCPs do not grant permissions; an Allow for eu-west-1 adds nothing beyond IAM. You must deny all other Regions so the restriction is actually enforced.
Related Analysis
Practice All SCS-C03 Questions
Access 86 questions with complete answers and detailed explanations.
View Full SCS-C03 Practice Test →