SCS-C02 aws:PrincipalOrgID Practice Question
A company uses AWS Organizations with multiple accounts. The security team wants to centralize the collection of VPC Flow Logs and AWS CloudTrail logs from all accounts into a single Amazon S3 bucket in the management account. The S3 bucket policy must allow cross-account log delivery. Which condition in the bucket policy should be used to restrict log delivery to only the organization's accounts?
⚠ Common exam trap
Candidates often confuse `aws:PrincipalOrgID` with `aws:SourceOrgId`. However, `aws:SourceOrgId` is not a valid AWS condition key. The correct key for restricting based on organization membership is `aws:PrincipalOrgID`. For cross-account log delivery, `aws:PrincipalOrgID` ensures that only accounts within the specified organization can perform the action.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
aws:PrincipalOrgID
The correct condition key is `aws:PrincipalOrgID`, which restricts access to principals (accounts, IAM roles, or users) that are members of the specified AWS Organization. When used in a bucket policy, it ensures that only accounts within the company's organization can deliver logs to the S3 bucket, even if the source account ID changes. Note that `aws:SourceOrgId` is not a valid AWS condition key; `aws:PrincipalOrgID` is the appropriate key for this purpose.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
aws:SourceArn
Why it's wrong here
aws:SourceArn restricts access based on the exact Amazon Resource Name of the source resource that makes the request, such as a specific CloudTrail trail ARN. It is useful for preventing confused deputy attacks where a single known resource calls the bucket, but it cannot express that any account within an organization may deliver logs. Additionally, aws:SourceArn is only applicable for certain services and does not scale to the entire organization, so it fails to meet the requirement here.
- ✗
aws:SourceOrgId
Why it's wrong here
There is no such condition key as aws:SourceOrgId in AWS Identity and Access Management; it is not among the global condition keys and is not supported in bucket policies. If you attempt to use it, the policy may fail validation or simply never match the request, so it cannot enforce that log deliveries originate only from accounts in the organization. The correct org-related key is aws:PrincipalOrgID, which exists specifically for this purpose.
- ✗
aws:SourceAccount
Why it's wrong here
aws:SourceAccount restricts the policy condition to a single, explicit AWS account ID that originates the request. While it would work for a static set of accounts, using it here would require manually updating the bucket policy every time an account is added to or removed from the organization, making it unscalable and error-prone. It also does not verify that the source account is managed by the same organization, so it fails to express the intended org-wide constraint. This makes it an inferior choice compared to aws:PrincipalOrgID.
- ✓
aws:PrincipalOrgID
Why this is correct
aws:PrincipalOrgID is a global IAM condition key that compares the unique organization ID of the principal's AWS account to the value you specify. In an S3 bucket policy, setting "aws:PrincipalOrgID": "o-12345" allows any principal from any account within that organization to deliver logs, automatically covering new accounts as they join. Because it operates on the principal's organization rather than the request source, it is the most scalable and appropriate condition for this cross-account logging scenario.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SCS-C02 question from scratch — 376 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.