Exam AWS Certified Solutions Architect - Professional topic 1 question 784 discussion

sat on this one for a while but i think ill settle for A. if you want to exclude regions you can use the SCP however some services a global resources so you use the Notaction to exempt the global services. If you want to allow roles to bypass the policy you can use the ArnNotLike and exclude certain admin roles from the SCP policy. This is NOT what we want to achieve, the goal is to block access to other regions, hence the System Manager roles should not be exempt. Where i'm slightly confused is how are we mandating the use of SSM? Users will be able to use any services within EU-WEST-2 including SSM.

Session Manager does not support cross-account access. You will need to assume a Role in account B (for example, from your user/role in account A) before starting the session. ... it seems to be B...

A for me, does what is asked

Choosing between A and B.. Can't see a condition or any reason SSM should AVOID region restriction - so A.

A) SSM not handled. B) region + SSM handled in SCP at root level ( ques says 'mandated') C) region handled at root with SCP + SSM left for accounts to handle( not 'mandated') and permission boundary cannot give perm if SCP denies it D) not at all centrally managed , needs SCP

D will not work for sure - its applied to session manager only C will not work also its aagain applied to SSM profile and it will not grant access its either A or B - for B it means we will allow the SSM ARN role to work on all regions only A left as the correct option - it will deny access to all regions with exception of eu-west-2 no need to do anything else as SSM is already allowed by SCP by default A - means we deny all access to other regions -

Its not B because that would apply the SCP for all users except The session manager IAM which would allow that account to do whatever it wants. I would say "D", why cant a simple permissions boundary simply deny access for sessions manager to all other regions? Why does it need an SCP?

I am not too convinced with C nor A. How about B? SCP will have deny to run EC2 with condition ArnNotLike the session-manager-profile-role

It's C. 1. Create SCP policy to privent denies access to any operations outside of the specified Region. https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps_examples_general.html#example-scp-deny-region 2. Create IAM Policy in each account from making certain changes https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html “ security team has required that all AWS accounts utilize AWS Systems Manager Session Manager “ IAM must be configured to allow access.

It's C.

why A?