A financial holding company runs 60 AWS accounts in AWS Organizations with separate OUs for prod and sandbox. Auditors require that no member account can leave the organization and S3 buckets cannot grant access to principals outside the organization, even if developers allow it. Which SCP and RCP combination enforces both identity and resource-based guardrails?
Select an answer to reveal the explanation.
Short Explanation
You nailed the split once you see who each policy leashes. SCPs curb identities, while RCPs curb resource policies, like two locks on different doors.
Full Explanation
The correct approach works because SCPs filter the maximum actions identities in member accounts can perform, making them ideal for denying organizations:LeaveOrganization centrally, while RCPs filter the maximum permissions granted by resource-based policies, making them ideal for capping S3 bucket policies to organization principals regardless of developer intent. An SCP denying S3 external access plus permissions boundary fails by concept because permissions boundaries apply only to specific IAM roles or users, not to resource policies or account-level actions, so bucket policies could still grant external access. An SCP plus VPC endpoint policy fails by concept because endpoint policies control only network-path access through that endpoint and do not constrain bucket policies granting external access over other paths. An IAM identity policy plus RCP fails by concept because identity policies must be attached in every account and can be altered locally, and RCPs cannot restrict identity-based organization membership actions. Exam caveat: remember SCPs never grant permissions and RCPs apply only to resource policies in supported services. Practical check: test both guardrails in a sandbox OU with a deliberately permissive bucket policy and a leave-organization attempt.