Security Foundations and Governance practice questions

Create an IAM policy that denies ec2:CreateVolume.

Why wrong: Denying 'ec2:CreateVolume' would completely block the ability to create new volumes, which is too restrictive for most business environments. The goal is to enforce security, not to prevent infrastructure provisioning, which is why an account-level encryption setting is preferred over a blanket denial of actions.

Apply a resource tag to all existing volumes.

Why wrong: Tags are metadata and do not provide any security enforcement functionality. While they are useful for categorization and cost allocation, they cannot be used to force encryption or prevent the creation of unencrypted volumes, making them entirely ineffective for fulfilling the security requirement for data-at-rest encryption.

Use AWS Trusted Advisor to delete unencrypted volumes.

Why wrong: Deleting resources based on an audit is highly disruptive and dangerous, as it may result in data loss for production workloads. Governance should focus on preventing the creation of insecure resources, not destroying live infrastructure, which makes this approach unsuitable for a managed, production-grade security environment.

AWS is responsible for configuring the customer's IAM policies.

Why wrong: IAM management is strictly a customer responsibility. AWS does not have visibility into the specific access requirements of a customer's business, so the customer must define, implement, and maintain the least-privilege policies that govern access to their specific resources, services, and sensitive information.

Customers are responsible for physical security of AWS data centers.

Why wrong: Physical security of the data centers, including biometric access and 24/7 guard presence, is exclusively the responsibility of AWS. Customers do not have physical access to the data centers, so they cannot be held responsible for the security of the physical infrastructure housing their resources.

Use the management account for all security administration.

Why wrong: Using the management account for daily operational tasks is a significant security risk. The management account should be highly restricted and used only for tasks that absolutely require its capabilities, such as account creation or organization-wide billing management, following AWS best practices for account separation.

Grant IAM full access to all security teams in each account.

Why wrong: Granting full IAM access in every individual account is operationally unmanageable and violates the principle of least privilege. It creates 50 disparate environments that are difficult to audit and secure, and it provides excessive permissions that could lead to accidental configuration drift or malicious internal activity.

Enable SCPs for all users in every account.

Why wrong: While SCPs are excellent for defining guardrails, they are not a substitute for delegated administration. SCPs define what is forbidden, but they do not help manage the operational workflow of security tools. Delegation is necessary to actually manage, analyze, and remediate findings within a centralized security account.

It lacks a condition block for MFA.

Why wrong: While adding an MFA condition is a good practice, the primary issue is the excessive scope of the 'Action' and 'Resource' fields. Even with MFA, having full S3 access across the entire account is a critical security failure, as it bypasses the need for granular, task-specific permissions.

It requires the 'Action' to be in a list format.

Why wrong: AWS IAM policies accept both strings and lists for the 'Action' element. The formatting itself is valid syntactically, but the logical content is dangerous. Technical validity does not equate to security compliance; in this case, the policy is valid but highly insecure and violates standard governance policies.

It does not specify a Region.

Why wrong: S3 is a global service, and resource-based policies generally don't require region specification unless restricted by conditions. The error here is the wildcard scope, not the absence of regional constraints. The broad scope allows the user to access data globally, increasing the attack surface unnecessarily.

Manual code reviews for every API call.

Why wrong: Manual reviews are not scalable for cloud environments and do not provide real-time governance. Governance must be automated to remain effective as infrastructure grows. Relying on manual processes introduces human latency and error, making it unsuitable for the pace and scale of modern cloud-native development cycles.

Deleting all IAM users and using only root.

Why wrong: Using the root account for daily operations is a severe security violation. The root account should be protected with MFA and strictly reserved for tasks that cannot be performed by IAM users. Governance requires the use of least-privileged IAM users or roles, not the abandonment of account security best practices.

Disabling all logs to save costs.

Why wrong: Disabling logs is the opposite of governance; it removes the visibility required for audit, incident response, and compliance. Effective security programs require detailed logging from CloudTrail, VPC Flow Logs, and other sources to maintain an accurate history of account activity, which is essential for forensic investigations.

Manual inspection of every bucket policy.

Why wrong: Manual inspection is impossible at scale and prone to human error. In an organization with hundreds of buckets, this approach would take too long and fail to detect real-time changes to policies, making it an ineffective strategy for maintaining continuous governance and security compliance across the environment.

AWS CloudTrail log analysis.

Why wrong: CloudTrail records actions, but it does not evaluate the current state of policy permissions for public access. While you could potentially reconstruct intent from logs, it is not designed to show you current resource-level access status, making it a poor tool for real-time security auditing of public access.

Enable S3 Block Public Access.

Why wrong: While enabling 'Block Public Access' is a critical preventative control, the question asks for a way to 'verify' the current status, not to prevent future issues. Access Analyzer is the verification and detection tool, whereas 'Block Public Access' is the preventative tool. Both are needed, but only one verifies state.

The policy requires the use of AWS KMS (SSE-KMS) for all uploads, and the developer used the default S3 managed keys.

Why wrong: The policy specifically checks for 'AES256', which corresponds to S3-managed encryption (SSE-S3). It does not mention 'aws:kms', which would be required for SSE-KMS. Therefore, the failure is not due to a requirement for KMS, but rather the absence of the specific SSE-S3 header required by the deny condition.

The resource specified in the Allow statement is for objects only, but the Deny statement applies to the entire bucket.

Why wrong: The resource 'arn:aws:s3:::company-data/*' targets objects within the bucket, which is correct for the PutObject action. The Deny statement uses a wildcard '*' for the resource. This means the deny applies to all resources, including the objects in that specific bucket, whenever the encryption condition is triggered.

The developer lacks the s3:ListBucket permission, which is required to perform a PutObject operation via the CLI.

Why wrong: While 's3:ListBucket' is often useful for CLI operations, it is not a technical requirement for the 's3:PutObject' action itself. The error 'Access Denied' during an upload specifically relates to the write permission or a deny policy, not the ability to list the contents of the bucket.

Configure a cross-account IAM role in every member account for the security account to pull findings.

Why wrong: Security Hub does not require manual cross-account IAM roles to aggregate findings when used with AWS Organizations. The service handles the data sharing between member accounts and the delegated administrator account natively. Using manual roles would add unnecessary complexity and administrative overhead to the security architecture.

Deploy an AWS Config aggregator in the management account to collect Security Hub findings.

Why wrong: AWS Config aggregators are used to collect configuration and compliance data from AWS Config, not findings from Security Hub. While both services contribute to security governance, they operate independently. Security Hub has its own built-in aggregation mechanism for multi-account environments when integrated with AWS Organizations.

Use an SCP to deny ec2:RunInstances if the 'CostCenter' tag is not present in the request.

Why wrong: An SCP with a condition for tags is a preventive control. While this ensures compliance, the requirement specifically states that resource creation should be allowed even if the tag is missing. This SCP would block the creation, failing the requirement for visibility over strict enforcement in this scenario.

Create an AWS Config rule in every account to check for the 'CostCenter' tag on EC2 instances.

Why wrong: AWS Config can detect missing tags, but managing this individually in every account is not as efficient as using a centralized Tag Policy. While Config is excellent for remediation, Tag Policies are specifically designed for organization-wide tagging governance and provide a more streamlined reporting mechanism for compliance.

Implement a Lambda function that runs on a schedule to scan all accounts and tag resources.

Why wrong: A custom Lambda-based solution is difficult to maintain and requires extensive cross-account permissions. It also does not provide a native compliance reporting interface. Using built-in features like Tag Policies is the AWS-recommended approach for governance as it integrates directly with the Organizations management console.

Amazon EBS Public Snapshots

Why wrong: Checking for public EBS snapshots is an important data privacy control, but it is not part of the 'core' checks provided to all customers. Like many other deep-dive security checks, it is reserved for customers who have subscribed to Business or Enterprise level support for their AWS environment.

The action will succeed because CloudFront is a global service and is not bound by regional SCP restrictions.

Why wrong: SCPs apply to all actions unless specifically excluded. Global services are not automatically exempt from regional conditions. Without a condition that excludes global service endpoints (like 'aws:PrincipalIsAWSService'), the SCP will evaluate the request against the region requirement, often resulting in a denial for global operations.

The action will succeed because the 'us-east-1' region is the default home for all global service metadata.

Why wrong: While it is true that many global services use 'us-east-1' for their control plane, the IAM condition 'aws:RequestedRegion' specifically looks for the region targeted by the API call. For many global services, this value is 'us-east-1', but for others, it may be 'global', which would fail the 'StringNotEquals' check.

The action will fail because the SCP lacks a 'NotAction' statement to permit global service operations.

Why wrong: While using a 'NotAction' or adding a condition to exclude global services is a best practice for regional restriction SCPs, the failure itself is caused by the 'Deny' statement's condition evaluating to true. The absence of an exclusion is what allows the deny to take effect on global services.

Attach a resource-based policy to the Transit Gateway that explicitly denies access to non-org principals.

Why wrong: While resource-based policies can restrict access, manually managing these for every shared resource is prone to error. RAM is designed to handle this at the service level. Furthermore, a resource policy doesn't prevent the RAM share itself from being created; it only controls the access to the underlying resource.

Use an SCP to deny the ram:CreateResourceShare action for all member accounts.

Why wrong: Denying 'ram:CreateResourceShare' would prevent member accounts from sharing any resources at all, even within the organization. The requirement is to allow sharing within the organization but prevent sharing outside of it. This SCP is too restrictive and would break the intended functionality of cross-account networking.

Configure a VPC Endpoint for RAM and restrict access using a VPC Endpoint policy.

Why wrong: VPC Endpoint policies control which principals can use the endpoint to reach a service, but they do not govern the internal logic of the service itself. A user could still create an external share via the public RAM endpoint or from another environment if the service-level settings are not configured.

There is no way to prevent the management account from leaving, but member accounts are locked in automatically.

Why wrong: The management account is the owner of the organization and technically cannot 'leave' it; it can only delete the organization if it is empty. Member accounts are not automatically 'locked in' unless specific permissions are restricted. Governance requires active configuration of SCPs to prevent accounts from being removed or leaving.

Enable 'Account Lockdown' in the AWS Organizations settings console.

Why wrong: There is no feature called 'Account Lockdown' in the AWS Organizations console. Governance and restrictions within Organizations are primarily handled through Service Control Policies (SCPs). Using non-existent features in a strategy would lead to a failure in maintaining the desired security posture and organizational structure.

Ensure that the organization was created in 'Consolidated Billing' mode only.

Why wrong: 'Consolidated Billing' mode is a limited version of AWS Organizations that does not support Service Control Policies (SCPs). To enforce governance and prevent accounts from leaving, the organization must be in 'All Features' mode. Consolidated billing only provides financial benefits without the security guardrails needed for governance.

AWS Config

Why wrong: AWS Config is primarily a resource inventory and configuration history service. While it evaluates compliance against rules, it does not provide the centralized threat-centric finding aggregation dashboard that Security Hub offers for cross-account security management, making it secondary to Security Hub for this specific auditor requirement.

Amazon GuardDuty

Why wrong: GuardDuty is a threat detection service that monitors for malicious activity and unauthorized behavior. While it feeds findings into Security Hub, it is not designed to act as the primary dashboard for aggregate organizational security findings or compliance posture management, which is the specific function of Security Hub.

AWS IAM Access Analyzer

Why wrong: IAM Access Analyzer helps identify resources shared with external entities by analyzing resource-based policies. Although it provides valuable security insights regarding permissions, it is specialized for identity and access governance rather than providing a holistic dashboard for security findings across all AWS services and accounts.

Enable S3 Block Public Access on all accounts via AWS Organizations.

Why wrong: While enabling S3 Block Public Access is a critical security best practice, it does not enforce encryption at rest. This configuration prevents data leaks to the public internet but does not influence or mandate the encryption status of the objects stored within the S3 buckets.

Use AWS Trusted Advisor to manually audit all buckets for encryption status.

Why wrong: Manual auditing via Trusted Advisor is a reactive measure and does not provide enforcement or governance. While it identifies buckets that are currently unencrypted, it does not prevent future occurrences, making it insufficient for an organization-wide mandate requiring strict, automated compliance for all data stored.

Apply a bucket policy to every S3 bucket in the account.

Why wrong: Applying individual bucket policies is operationally expensive and prone to human error, especially in large environments. Governance should be applied at the organizational level using SCPs rather than managing individual resource policies, which can be modified or deleted by users with sufficient IAM permissions.

The policy lacks a wildcard in the resource ARN.

Why wrong: The resource ARN correctly includes '/*' to match all objects within the bucket. The issue is not the scope of the resource but rather the logic of the condition check, which only evaluates the header if it happens to be provided in the request.

The 'Effect' should be changed to 'Allow'.

Why wrong: Changing the effect to 'Allow' would not enforce encryption; it would simply permit the action. An 'Allow' statement does not provide the restriction required to block non-compliant traffic, as 'Deny' statements are required for robust security guardrails that override any conflicting 'Allow' permissions.

The policy needs an 'Action' of 's3:PutObjectTagging'.

Why wrong: Adding tagging permissions does not influence encryption behavior. The 'PutObject' action is the correct focus for controlling object uploads, but the current condition logic is the failure point, as it assumes the header is always present, which is not guaranteed for every incoming S3 request.

Amazon CloudWatch Logs

Why wrong: CloudWatch Logs stores and monitors log data from applications and services. While it can receive CloudTrail logs, it is not the primary service for capturing API activity; CloudTrail is the engine that generates the events. CloudWatch is for analysis, not the initial collection of API trails.

AWS Config

Why wrong: AWS Config tracks configuration changes to resources over time. While it records changes, it does not capture the granular API call logs necessary for a comprehensive audit of who performed an action, when, and from where, making it complementary to, but not a replacement for, CloudTrail.

AWS Systems Manager

Why wrong: Systems Manager is an operational management service used for patching, automation, and configuration of instances. It is not designed to function as an audit logging service for AWS API activities across the platform, and therefore cannot replace the functionality provided by AWS CloudTrail for security governance.

Use AWS Budgets to force tagging.

Why wrong: AWS Budgets is designed for tracking spending and sending notifications. It lacks the technical capability to enforce resource tagging or detect missing tags on infrastructure. Tagging governance must be enforced through configuration monitoring services like AWS Config, not through a billing-focused service that monitors cost metrics.

Use an IAM policy to prevent resource creation.

Why wrong: While IAM policies can restrict actions, they are not effective for enforcing metadata requirements like tags at the time of resource creation for most services. IAM policies govern API calls, but the complex logic required to validate the presence of specific tags on dynamic objects is better handled by Config.

Use AWS Trusted Advisor to tag resources.

Why wrong: Trusted Advisor provides recommendations for cost optimization and security; it does not have the capability to automatically apply or enforce tags on resources. Governance requires active monitoring and rule-based enforcement, which Trusted Advisor does not provide in the context of resource-level tagging compliance.

Assign the 'AdministratorAccess' policy to all users.

Why wrong: Assigning 'AdministratorAccess' to all users violates the principle of least privilege. It gives users excessive, unnecessary permissions, which increases the risk of accidental resource destruction or malicious insider threats. Effective security requires granular control where permissions are tailored to individual job functions and business needs.

Use only root account credentials for all tasks.

Why wrong: Using the root account is a major security violation. The root account has full access to everything in the account, including billing and account closure, and should never be used for daily tasks. IAM best practices mandate the creation of specific users or roles for every unique identity.

Allow all traffic in Security Groups.

Why wrong: Allowing all traffic in Security Groups is a network security failure. Governance requires that network ports and protocols are strictly limited to the absolute minimum necessary for application functionality, preventing unauthorized access to instances and databases. This is a network-level application of the least-privilege principle.

The CIDR range is too small for VPC traffic.

Why wrong: The CIDR range is a valid network notation and has no impact on the technical validity of the IAM policy. The issue is not the size of the range, but rather the overall evaluation logic of IAM policies, which involves multiple layers of potential denials across the environment.

The resource ARN is missing the bucket name.

Why wrong: The resource ARN 'arn:aws:s3:::my-bucket/*' is correctly formatted and includes the bucket name. The issue is not the resource pathing, but rather the global permission evaluation logic that applies across different policy types when multiple layers are involved in controlling access to sensitive data.

S3 does not support the 'aws:SourceIp' condition.

Why wrong: S3 fully supports the 'aws:SourceIp' condition key. The limitation is not with the service, but with the evaluation hierarchy of policies. The user's inability to access the bucket is likely due to other conflicting policies or missing permissions, not a limitation of the condition key itself.