Exam AWS Certified Security - Specialty SCS-C02 topic 1 question 236 discussion

The correct answer is D The company is rapidly scaling to 1,000+ AWS accounts and needs to delegate IAM role creation while ensuring security and preventing privilege escalation. The best approach is to use: Service Control Policies (SCPs): These apply at the organizational level in AWS Organizations to enforce security rules across all accounts. Permissions Boundaries: These ensure that even if teams create IAM roles, they cannot grant excessive permissions beyond what the security team allows. This solution meets the requirements with the least operational overhead because: ✅ Application teams can create IAM roles themselves, reducing the security team's backlog. ✅ SCPs prevent teams from overriding security policies or creating overly permissive roles. ✅ Permissions boundaries ensure IAM roles have restricted permissions, preventing privilege escalation.

D. Create an SCP and a permissions boundary for IAM roles. Add the SCP to the root OU so that only roles that have the permissions boundary attached can create any new IAM roles. Service Control Policies (SCPs) and permissions boundaries are effective tools for controlling the maximum permissions an IAM role can have within an AWS Organization. By attaching an SCP to the root organizational unit (OU), you ensure that only roles with the permissions boundary can be created, which enforces strict controls on what these roles can do. This approach allows application teams to create roles within the defined boundaries, reducing the security team's workload and preventing privilege escalation.