Q38 — AWS SAA-C03 Ch.17

Question 38 of 89 | ← Chapter 17

Q1338. A global company operates in multiple AWS Regions to meet data residency requirements. The company uses AWS Organizations to manage its accounts.The company wants to restrict IAM roles and access to specific Regions to prevent accidental data operations across geographic boundaries.Which solution will meet these requirements?

Correct Answer: A. Configure a service control policy(SCP) to deny the ec2:RunInstances action in non-compliant Regions.

Explanation

A OR B.- To centrally restrict actions across all accounts in an AWS Organization, Service Control Policies (SCPs) are the appropriate mechanism. SCPs are enforced at the organization or OU level and can deny actions in specific Regions for all principals in member accounts, preventing accidental cross-region operations before IAM policy evaluation.- Example SCP pattern: Deny actions unless aws:RequestedRegion is in an allowed list, or explicitly deny ec2:RunInstances (and other sensitive actions) when aws:RequestedRegion is not one of your permitted Regions. This enforces Region restrictions organization-wide and applies to current and future accounts without having to modify per-account IAM policies.Why the others are not ideal:- B (IAM policies with aws:RequestedRegion): IAM policies can restrict by region, but they must be applied to each principal or role in every account. This is operationally heavy for many accounts and won't centrally prevent a new principal from being created that can act outside the desired Regions.- C (trust policies with aws:SourceIp): Trust policies control who can assume a role and are based on source IP; they don't meaningfully restrict actions by Region and aren't suitable for enforcing geographic constraints.- D (AWS Config): AWS Config can detect and alert on noncompliant resource activity after it happens, but it cannot prevent the action. The requirement is to restrict access to prevent accidental operations, so a preventive control like an SCP is required.