AWS Certified Solutions Architect – Professional — Question 575

A large company in Europe plans to migrate its applications to the AWS Cloud. The company uses multiple AWS accounts for various business groups. A data privacy law requires the company to restrict developers' access to AWS European Regions only.
What should the solutions architect do to meet this requirement with the LEAST amount of management overhead?

Answer options

• A. Create IAM users and IAM groups in each account. Create IAM policies to limit access to non-European Regions. Attach the IAM policies to the IAM groups.
• B. Enable AWS Organizations, attach the AWS accounts, and create OUs for European Regions and non-European Regions. Create SCPs to limit access to non-European Regions and attach the policies to the OUs.
• C. Set up AWS Single Sign-On and attach AWS accounts. Create permission sets with policies to restrict access to non-European Regions. Create IAM users and IAM groups in each account.
• D. Enable AWS Organizations, attach the AWS accounts, and create OUs for European Regions and non-European Regions. Create permission sets with policies to restrict access to non-European Regions. Create IAM users and IAM groups in the primary account.

Correct answer: B

Explanation

AWS Organizations and Service Control Policies (SCPs) provide the most efficient, centralized method to enforce regional restrictions across multiple AWS accounts with minimal management overhead. Creating and managing individual IAM policies, users, or groups across separate accounts as suggested in options A and C introduces significant administrative overhead and increases the risk of misconfiguration. Option D is incorrect because permission sets are a feature of AWS IAM Identity Center (formerly AWS Single Sign-On) and cannot be directly applied to Organizational Units (OUs) in AWS Organizations in the manner described.