A company manages multiple AWS accounts using AWS Organizations. The security team needs to enforce a policy that prevents any user, including the root user, in any member account from disabling the 'Block Public Access' setting on Amazon S3 buckets. The policy must be centrally managed and automatically applied to all existing and future member accounts. Which AWS feature should the security team use?

AWS Identity and Access Management (IAM) policy

IAM policies are attached to IAM users, groups, or roles within a single account. They cannot restrict the root user of that account, and they do not apply across multiple accounts in an organization. Therefore, this option does not meet the requirement for central enforcement across all member accounts.

AWS Config rule with automatic remediation

AWS Config can evaluate resource configurations against rules and trigger automatic remediation actions (e.g., re-enabling Block Public Access). However, it operates by detecting noncompliant resources after the action has occurred, not by preventing the action in the first place. It also cannot prevent the root user from taking an action and is not a preventive control.

AWS Trusted Advisor

AWS Trusted Advisor provides best-practice checks and recommendations, including checks for S3 buckets with public access. However, it only reports on the current state; it does not enforce policies or prevent users from changing settings. It is an advisory tool, not a preventive control mechanism.

What does this CLF-C02 question test?

Standard ACLs match source addresses.

What is the correct answer to this question?

The correct answer is: AWS Service Control Policy (SCP) — Service Control Policies (SCPs) are a feature of AWS Organizations that allow you to centrally control the maximum available permissions for all accounts in your organization. SCPs can be applied to the root organizational unit (OU) or to individual accounts, and they affect all users, including the root user, in the member accounts. In this scenario, an SCP can deny the s3:PutBucketPublicAccessBlock action to enforce the 'Block Public Access' setting. IAM policies cannot restrict the root user and are not centrally managed across accounts. AWS Config can detect noncompliant resources but cannot prevent actions. AWS Trusted Advisor provides recommendations but does not enforce policies.

What should I do if I get this CLF-C02 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.