A company uses AWS Organizations with multiple accounts. The security team wants to enforce a policy that prevents any user, including account administrators, from creating Amazon S3 buckets that are publicly accessible across the entire organization. The policy must be centrally managed and cannot be overridden by individual account administrators. Which AWS feature should the security team use?

AWS Config rules with auto-remediation

AWS Config rules are used to evaluate resource configurations for compliance, and auto-remediation can trigger actions to fix noncompliant resources. However, they do not prevent the creation of publicly accessible S3 buckets in real time; they react after the resource is created. Additionally, account administrators could disable or modify the rules. This does not meet the requirement for a policy that cannot be overridden.

AWS Identity and Access Management (IAM) policies with a Deny effect

IAM policies can deny actions, but they are attached to individual IAM users, groups, or roles within a single AWS account. Account administrators have full control over IAM policies in their own account and could create policies that override these denials. This approach does not provide centralized, unchangeable enforcement across all accounts in the organization.

Amazon Macie with automated response

Amazon Macie is a fully managed data security and data privacy service that uses machine learning to discover, monitor, and protect sensitive data in AWS. It can alert on publicly accessible S3 buckets, but it does not have the ability to prevent the creation of such buckets. It is a detection tool, not an enforcement mechanism, and it does not provide a policy that account administrators cannot override.

What does this CLF-C02 question test?

Standard ACLs match source addresses.

What is the correct answer to this question?

The correct answer is: Service Control Policies (SCPs) in AWS Organizations — The correct answer is Service Control Policies (SCPs). SCPs are a feature of AWS Organizations that allow you to centrally control the maximum available permissions for all accounts in your organization. SCPs can restrict actions that accounts can perform, and they cannot be overridden by IAM policies in those accounts. In this scenario, an SCP can deny actions that make S3 buckets public, such as allowing public bucket policies or ACLs. IAM policies are account-specific and can be overridden by account admins. AWS Config rules can detect noncompliant resources but do not prevent the action. Amazon Macie is for discovering sensitive data, not for enforcing access policies.

What should I do if I get this CLF-C02 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.