Using SCPs to Restrict EC2 Launches to Specific Regions
Exhibit
Refer to the exhibit.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Deny",
"Action": "ec2:*",
"Resource": "*",
"Condition": {
"StringNotEquals": {
"aws:RequestedRegion": ["us-east-1", "eu-west-1"]
}
}
}
]
}A company attaches the above SCP to the root organizational unit. The development team in a member account wants to launch an EC2 instance in the ap-southeast-1 region. What will happen?
Quick Answer
The answer is that the EC2 instance launch will be denied because the SCP explicitly blocks actions in any region not listed. This occurs because the SCP uses a Deny effect for all EC2 actions on any region outside of us-east-1 and eu-west-1, and since ap-southeast-1 is not in that allowed list, the deny overrides the default implicit allow. On the AWS Certified Solutions Architect Professional SAP-C02 exam, this scenario tests your understanding of how SCP region restrictions interact with service control policies at the root OU level—a common trap is assuming that an explicit allow elsewhere can override a deny, but SCPs act as a boundary that applies to all IAM principals in the account. Remember the key principle: an explicit Deny always wins over any Allow, so when an SCP denies a region, no amount of IAM permissions can bypass it. Memory tip: “Deny denies all, even if Allow calls.”
⚠ Common exam trap
A common mix-up: candidates assume SCPs only restrict permissions (like a boundary) and do not deny, or that IAM permissions can override SCPs, but in reality SCPs can explicitly deny actions and always take precedence over IAM allows.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The EC2 instance launch will be denied because the SCP denies actions in regions not listed.
SCPs are evaluated using a deny-by-default model where any action not explicitly allowed is implicitly denied. The SCP in question denies all EC2 actions in any region not listed in the allow list (us-east-1 and eu-west-1). Since ap-southeast-1 is not in that list, the EC2 launch is denied regardless of any IAM permissions the developer may have.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The EC2 instance launch will be denied only if there is an explicit allow for us-east-1 and eu-west-1.
Why it's wrong here
Deny always overrides allow.
- ✗
The EC2 instance launch will succeed because SCPs only restrict permissions, not deny.
Why it's wrong here
SCPs can deny.
- ✓
The EC2 instance launch will be denied because the SCP denies actions in regions not listed.
Why this is correct
The SCP explicitly denies ec2:* in disallowed regions.
- ✗
The EC2 instance launch will succeed if the developer has IAM permissions to launch in ap-southeast-1.
Why it's wrong here
SCP overrides IAM permissions.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 1,660 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SAP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company wants to centralize access control for multiple AWS accounts using AWS Organizations. They need to allow developers in a specific account to launch EC2 instances only in certain regions. What is the most scalable solution?
medium- A.Create an IAM role in each account with a policy to deny non-compliant regions.
- B.Use AWS Config rules to detect and terminate instances in non-compliant regions.
- ✓ C.Use an SCP attached to the organizational unit to deny EC2 actions in non-compliant regions.
- D.Create an IAM policy in each account to deny non-compliant regions.
Why C: Service control policies (SCPs) in AWS Organizations allow you to centrally define the maximum permissions for all accounts in an organizational unit (OU). By attaching an SCP that denies EC2 actions in non-compliant regions, you enforce the restriction across multiple accounts without needing to manage individual IAM policies or roles, making it the most scalable solution.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.