SAP-C02 Service Control Policy (SCP) Practice Question

A company is using AWS Organizations and wants to restrict the use of specific instance types across all accounts. The company wants to allow only t3.micro, t3.small, m5.large, and m5.xlarge instances. Which SCP should be applied?

⚠ Common exam trap

Candidates might choose Option A because it uses a similar deny condition but with a broader resource '*' and wildcards. However, the resource must be specific to the instance for the condition to be evaluated, and wildcards are not supported in StringNotEquals, making Option A ineffective.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

{"Effect":"Deny","Action":"ec2:RunInstances","Resource":"arn:aws:ec2:*:*:instance/*","Condition":{"StringNotEquals":{"ec2:InstanceType":["t3.micro","t3.small","m5.large","m5.xlarge"]}}}

The correct SCP because it targets the instance resource with a resource ARN and uses a Deny effect with StringNotEquals to block any instance types not in the allowed list. By listing the specific instance types explicitly, the policy avoids the unsupported use of wildcards in StringNotEquals conditions for ec2:InstanceType. This ensures that only the specified instance types can be launched.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
{"Effect":"Deny","Action":"ec2:RunInstances","Resource":"*","Condition":{"StringNotEquals":{"ec2:InstanceType":["t3.*","m5.*"]}}}
Why it's wrong here
Uses a wildcard '*' resource, which may not evaluate the condition key properly, and wildcards in StringNotEquals are not supported for ec2:InstanceType.
✓
{"Effect":"Deny","Action":"ec2:RunInstances","Resource":"arn:aws:ec2:*:*:instance/*","Condition":{"StringNotEquals":{"ec2:InstanceType":["t3.micro","t3.small","m5.large","m5.xlarge"]}}}
Why this is correct
Correct. Deny with StringNotEquals using specific instance types and instance resource ARN.
✗
{"Effect":"Allow","Action":"ec2:RunInstances","Resource":"*","Condition":{"StringEquals":{"ec2:InstanceType":["t3.*","m5.*"]}}}
Why it's wrong here
Uses an Allow effect, which is not recommended for SCPs because it does not restrict other services, and StringEquals with wildcards is also unsupported.
✗
{"Effect":"Deny","Action":"ec2:RunInstances","Resource":"*"}
Why it's wrong here
Denies all RunInstances actions without any condition, preventing any instance launches.

Go deeper

SAP-C02 Service Control Policy (SCP) Practice Question

Why each option matters

Option-by-option breakdown

Related to this question