A company uses AWS Organizations to centrally manage multiple AWS accounts. The security team requires that no IAM users can be created in any member account. All access must use federated identities from the company's existing identity provider. The security team needs a single, centralized mechanism to enforce this restriction across all existing and future member accounts. Which AWS feature should the security team use to meet this requirement?

AWS Identity and Access Management (IAM) policies

IAM policies are attached to IAM users, groups, or roles within a single account. They cannot enforce restrictions across multiple accounts or prevent the root user from creating IAM users. They also do not apply automatically to new accounts added to the organization.

AWS Config managed rules with automatic remediation

AWS Config rules can detect when an IAM user is created (non-compliant) and trigger automatic remediation actions, but they cannot prevent the creation in the first place. This is a detective and reactive solution, not a preventive one, and it requires per-account configuration.

IAM Access Analyzer

IAM Access Analyzer is used to analyze resource-based policies (e.g., S3 bucket policies, IAM roles) to identify resources shared with external principals. It does not have the ability to enforce restrictions on the creation of IAM users.

What does this CLF-C02 question test?

Standard ACLs match source addresses.

What is the correct answer to this question?

The correct answer is: AWS Organizations service control policies (SCPs) — To enforce a policy that prevents the creation of IAM users across all member accounts in an AWS Organization, the security team should use AWS Organizations service control policies (SCPs). SCPs are applied at the organization, organizational unit (OU), or account level and can deny specific API actions, such as IAM:CreateUser, for all users and roles (including the root user) in affected accounts. This provides a centralized governance mechanism that automatically applies to new member accounts added to the organization. IAM policies are account-specific and cannot enforce restrictions across multiple accounts. AWS Config rules can detect non-compliance after the fact but cannot prevent the action. IAM Access Analyzer analyzes resource policies for external access but does not control user creation.

What should I do if I get this CLF-C02 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.