A Company Manages Hundreds of AWS Accounts Centrally in an Organization

question 309

Multiple Choice

A company manages hundreds of AWS accounts centrally in an organization in AWS Organizations. The company recently started to allow product teams to create and manage their own S3 access points in their accounts. The S3 access points can be accessed only within VPCs, not on the Internet. What is the MOST operationally efficient way to enforce this requirement?

• A) Set the S3 access point resource policy to deny the s3:CreateAccessPoint action unless the s3:AccessPointNetworkOrigin condition key evaluates to VPC.
• B) Create an SCP at the root level in the organization to deny the s3:CreateAccessPoint action unless the s3:AccessPointNetworkOrigin condition key evaluates to VPC.
• C) Use AWS CloudFormation StackSets to create a new IAM policy in each AWS account that allows the s3:CreateAccessPoint action only if the s3:AccessPointNetworkOrigin condition key evaluates to VPC.
• D) Set the S3 bucket policy to deny the s3:CreateAccessPoint action unless the s3:AccessPointNetworkOrigin condition key evaluates to VPC.

---

Definitions:

USDA

The United States Department of Agriculture, a federal agency responsible for regulating and supporting farming, agriculture, forestry, and food.

Crisis Communications

The process by which organizations respond to and manage the situation to minimize damage to products, people, the public, and/or their reputation.

Lean Finely Text Beef

A type of processed beef product that is made by separating the fat from the meat in trimmings and treating it with ammonia to kill bacteria.

Public Hysteria

A state of intense and irrational fear or panic among a group of people, often in response to a perceived threat or crisis.