How to Prevent S3 Public Access Across All AWS Accounts Using Service Control Policies
A company uses AWS Organizations to manage multiple AWS accounts. The security team needs to ensure that no Amazon S3 bucket in any account within the organization can be made publicly accessible. The team wants a centrally managed, preventive control that applies to all existing and future accounts and cannot be overridden by individual account administrators. Which AWS feature should the security team use to meet these requirements?
Quick Answer
The answer is a service control policy (SCP) in AWS Organizations. An SCP acts as a centrally managed permission guardrail that can deny actions like `s3:PutBucketPublicAccessBlock` across every account in the organization, ensuring no S3 bucket can be made publicly accessible. Because SCPs apply to all existing and future accounts and cannot be overridden by individual account administrators, they provide the preventive control required to prevent S3 public access across all AWS accounts. On the AWS Certified Cloud Practitioner CLF-C02 exam, this scenario tests your understanding of the difference between preventive controls (SCPs) and detective controls (like AWS Config or IAM policies). A common trap is choosing a bucket policy or IAM role, but those can be bypassed by account admins; SCPs are the only option that enforces a hard block from the management account. Memory tip: think of an SCP as a “security constitution” that no lower-level policy can violate.
⚠ Common exam trap
It's easy for candidates to confuse detective controls (like AWS Config rules) with preventive controls (like SCPs), or assume account-level settings (like S3 Block Public Access) can be centrally enforced across an organization without an SCP.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Service control policy (SCP) in AWS Organizations
Service control policies (SCPs) in AWS Organizations allow you to centrally define and enforce permission guardrails across all accounts in the organization. An SCP that denies the `s3:PutBucketPublicAccessBlock` action and related public-access actions ensures that no S3 bucket can be made publicly accessible, and this policy applies to all existing and future accounts without being overridden by individual account administrators.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
S3 Block Public Access account-level settings
Why it's wrong here
Account-level S3 Block Public Access settings can be applied per account, but they are not centrally enforceable across all accounts in an organization with a single configuration. Individual account administrators could disable or modify these settings, so this does not meet the requirement for a central, non-overridable control.
When this WOULD be correct
A company needs to block all public access to S3 buckets within a single AWS account, and the account administrator wants a simple, account-wide setting that applies to all current and future buckets in that account.
- ✗
AWS Config managed rule s3-bucket-public-read-prohibited
Why it's wrong here
AWS Config rules are detective controls. They can evaluate bucket configurations and report noncompliant resources, but they do not prevent the action from occurring. The team wants a preventive control that prohibits making buckets public in the first place.
When this WOULD be correct
A question requiring detective monitoring of existing S3 bucket public access across accounts, with no need for preventive enforcement or central override prevention.
- ✗
Amazon Macie with a sensitive data discovery job
Why it's wrong here
Amazon Macie is a data security service that uses machine learning to discover, classify, and protect sensitive data in S3. It does not provide any mechanism to prevent buckets from being made publicly accessible; it focuses on data content rather than access control.
When this WOULD be correct
A company needs to identify and alert on S3 buckets that contain sensitive data (e.g., PII) and are publicly accessible. The security team wants automated discovery and reporting of such buckets across multiple accounts, but does not require a preventive block.
- ✓
Service control policy (SCP) in AWS Organizations
Why this is correct
Service control policies (SCPs) are a feature of AWS Organizations. They allow centralized, preventive control over the maximum permissions granted to accounts within the organization. An SCP can deny actions that would make an S3 bucket public, such as s3:PutBucketAcl or s3:PutBucketPolicy. SCPs apply to all accounts (including future accounts) and cannot be overridden by account administrators, meeting all requirements.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.
✓Service control policy (SCP) in AWS OrganizationsCorrect answer▾
Why this is correct
Service control policies (SCPs) are a feature of AWS Organizations. They allow centralized, preventive control over the maximum permissions granted to accounts within the organization. An SCP can deny actions that would make an S3 bucket public, such as s3:PutBucketAcl or s3:PutBucketPolicy. SCPs apply to all accounts (including future accounts) and cannot be overridden by account administrators, meeting all requirements.
✗S3 Block Public Access account-level settingsWrong answer — click to see why▾
Why this is wrong here
S3 Block Public Access account-level settings can be overridden by individual account administrators and do not apply automatically to new accounts created outside the organization's management account.
★ When this WOULD be the correct answer
A company needs to block all public access to S3 buckets within a single AWS account, and the account administrator wants a simple, account-wide setting that applies to all current and future buckets in that account.
Why candidates choose this
Candidates may think S3 Block Public Access is a centralized control because it can be applied at the account level, but they overlook that it is not enforced across multiple accounts in an organization and can be changed by account admins.
✗AWS Config managed rule s3-bucket-public-read-prohibitedWrong answer — click to see why▾
Why this is wrong here
AWS Config managed rules are detective, not preventive; they can detect public buckets but do not block them, and they can be overridden by account administrators.
★ When this WOULD be the correct answer
A question requiring detective monitoring of existing S3 bucket public access across accounts, with no need for preventive enforcement or central override prevention.
Why candidates choose this
Candidates may confuse AWS Config's detection capabilities with preventive controls, or think a managed rule can enforce compliance across accounts.
✗Amazon Macie with a sensitive data discovery jobWrong answer — click to see why▾
Why this is wrong here
Amazon Macie is a data security service that discovers sensitive data using machine learning, but it does not provide preventive controls to block public access to S3 buckets. It is detective, not preventive, and cannot enforce policies across all accounts.
★ When this WOULD be the correct answer
A company needs to identify and alert on S3 buckets that contain sensitive data (e.g., PII) and are publicly accessible. The security team wants automated discovery and reporting of such buckets across multiple accounts, but does not require a preventive block.
Why candidates choose this
Candidates may confuse Macie's ability to detect public access with a preventive control, or think that sensitive data discovery inherently includes access restriction capabilities.
Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 988 original CLF-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
4 more ways this is tested on CLF-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company manages 15 AWS accounts and wants to centrally deploy and enforce consistent AWS WAF rules, security groups, and Shield Advanced protections across all accounts and regions from a single administrator account. Which AWS service provides this centralised security policy management?
medium- A.AWS WAF
- B.AWS Security Hub
- ✓ C.AWS Firewall Manager
- D.AWS Shield Advanced
Why C: AWS Firewall Manager is the correct service because it provides centralized security policy management across multiple AWS accounts and regions. It allows an administrator to define and enforce AWS WAF rules, security group rules, and Shield Advanced protections from a single administrator account, ensuring consistent compliance across all accounts in an AWS Organization.
Variation 2. A company uses AWS Organizations to centrally manage multiple AWS accounts. The security team requires a mechanism to prevent any IAM user or role in any member account from modifying Amazon S3 bucket policies to grant public access. The solution must be enforced centrally and cannot be overridden by account administrators. Which AWS feature should the company use?
medium- A.IAM permissions boundaries
- ✓ B.Service control policies (SCPs)
- C.AWS Config conformance packs
- D.AWS CloudTrail Insights
Why B: Service control policies (SCPs) are the correct choice because they allow AWS Organizations to centrally define permission guardrails that apply to all IAM users and roles across member accounts. SCPs can explicitly deny actions like s3:PutBucketPolicy to prevent any account administrator from modifying S3 bucket policies to grant public access, and these restrictions cannot be overridden by any IAM entity within the member account.
Variation 3. A company uses AWS Organizations to centrally manage multiple AWS accounts. The security team requires that no IAM users can be created in any member account. All access must use federated identities from the company's existing identity provider. The security team needs a single, centralized mechanism to enforce this restriction across all existing and future member accounts. Which AWS feature should the security team use to meet this requirement?
medium- A.AWS Identity and Access Management (IAM) policies
- ✓ B.AWS Organizations service control policies (SCPs)
- C.AWS Config managed rules with automatic remediation
- D.IAM Access Analyzer
Why B: AWS Organizations service control policies (SCPs) allow a central administrator to define maximum permissions for all accounts within an organization. By creating an SCP that explicitly denies the `iam:CreateUser` action, the security team can enforce that no IAM users can be created in any member account, including future accounts, because SCPs are inherited by all accounts in the organization. This provides a single, centralized mechanism that cannot be overridden by account-level IAM policies.
Variation 4. A company uses AWS Organizations to manage multiple AWS accounts. The security team needs to ensure that Amazon CloudTrail is enabled in all AWS Regions for every member account, and that no user (including account administrators) can disable it. The policy must apply automatically to any new accounts that are added to the organization. Which AWS feature should the security team use to enforce this requirement?
medium- A.IAM policies with a Deny effect for CloudTrail actions
- B.AWS Config rules with an auto-remediation action
- ✓ C.Service Control Policies (SCPs)
- D.AWS CloudTrail trails with multi-region and organization trail enabled
Why C: Service Control Policies (SCPs) are the correct choice because they allow the security team to centrally control the maximum available permissions for all accounts within an AWS Organization. By creating an SCP that denies all CloudTrail disabling actions (e.g., `cloudtrail:StopLogging`, `cloudtrail:DeleteTrail`) and attaching it to the root or specific organizational units, the policy applies automatically to all existing and new member accounts, and even account administrators cannot override it. This ensures CloudTrail remains enabled across all Regions in every account, meeting the enforcement requirement.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.