AWS Certified Solutions Architect – Professional — Question 473

A company manages hundreds of AWS accounts centrally in an organization in AWS Organizations. The company recently started to allow product teams to create and manage their own S3 access points in their accounts. The S3 access points can be accessed only within VPCs, not on the Internet.
What is the MOST operationally efficient way to enforce this requirement?

Answer options

• A. Set the S3 access point resource policy to deny the s3:CreateAccessPoint action unless the s3:AccessPointNetworkOrigin condition key evaluates to VPC.
• B. Create an SCP at the root level in the organization to deny the s3:CreateAccessPoint action unless the s3:AccessPointNetworkOrigin condition key evaluates to VPC.
• C. Use AWS CloudFormation StackSets to create a new IAM policy in each AWS account that allows the s3:CreateAccessPoint action only if the s3:AccessPointNetworkOrigin condition key evaluates to VPC.
• D. Set the S3 bucket policy to deny the s3:CreateAccessPoint action unless the s3:AccessPointNetworkOrigin condition key evaluates to VPC.

Correct answer: B

Explanation

Using a Service Control Policy (SCP) applied at the root of AWS Organizations is the most operationally efficient way to enforce compliance across hundreds of member accounts centrally. This SCP prevents the creation of any S3 access point that does not have its network origin restricted to a VPC by utilizing the s3:AccessPointNetworkOrigin condition key. Configuring individual S3 bucket policies, access point resource policies, or IAM policies across hundreds of accounts is operationally complex and prone to configuration drift.