SAA-C03 Practice Question: SCPs set the maximum permissions for all…

Use AWS Control Tower guardrails to enforce region restriction for all accounts

Control Tower implements guardrails using SCPs. The direct mechanism is an SCP. Specifying Control Tower is less precise than the correct answer of directly applying an SCP to the Organization root.

Create IAM policies with Deny for disallowed regions and attach them to all IAM users and roles in each account

IAM policies are account-scoped and can be modified by account administrators. This is unscalable and bypassable — not an organization-wide immutable control.

Enable AWS Config rules to detect resources launched in disallowed regions and trigger auto-remediation to delete them

Config rules are detective controls that identify violations after resources are created. This does not prevent resource creation — it is reactive, not preventive.

What does this SAA-C03 question test?

SCPs set the maximum permissions for all principals in member accounts

What is the correct answer to this question?

The correct answer is: Create an SCP with a Deny on all actions for regions outside us-east-1 and eu-west-1, attached to the Organization root — Service Control Policies (SCPs) in AWS Organizations provide a guardrail that applies to all principals in member accounts — including IAM users, roles, and even the account root. SCPs restrict the maximum permissions that can be granted within an account. An SCP with Deny on all actions for all regions except us-east-1 and eu-west-1, attached to the organization root, prevents any account from launching resources in other regions regardless of account-level IAM permissions. IAM policies in member accounts cannot override SCPs.

What should I do if I get this SAA-C03 question wrong?

Review sCPs set the maximum permissions for all principals in member accounts, then practise related SAA-C03 questions on the same topic to reinforce the concept.