You manage multiple AWS accounts under AWS Organizations. A compliance requirement states: no account is allowed to create new IAM access keys for IAM users. Local administrators may attempt to override permissions. Which mechanism should you use to enforce this guardrail across all accounts?

An IAM permissions policy attached to a role that only your security team uses

An IAM policy limits what the specific role can do, but it does not prevent other accounts or other principals from creating access keys.

A KMS key policy that blocks key creation and reuse

KMS key policies control cryptographic key usage, not IAM access key creation. They do not enforce IAM action restrictions across accounts.

A permission boundary on a single IAM role

Permission boundaries apply to a specific role and do not automatically cover all principals across all accounts. They also do not override the need for organization-wide enforcement.

What does this SAA-C03 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: An Organizations service control policy (SCP) that explicitly denies CreateAccessKey — Service control policies (SCPs) are the correct control for organization-wide restrictions across multiple AWS accounts. When an SCP explicitly denies an IAM action such as CreateAccessKey, that restriction applies to all principals within the affected accounts and cannot be bypassed by more permissive identity-based IAM policies. This matches the compliance requirement that local administrators may try to override permissions, but the guardrail must remain enforced globally. Why others are wrong: IAM permission policies are scoped to a specific principal, so they cannot prevent other principals from performing the action. KMS key policies only affect cryptographic key usage and are unrelated to IAM access key operations. Permission boundaries limit effective permissions for roles that have boundaries attached, but they do not enforce a centralized restriction across all member accounts and principals.

What should I do if I get this SAA-C03 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.