A company uses AWS Organizations with dozens of member accounts. Security wants to guarantee that no member account can disable CloudTrail or move resources to unapproved Regions, even if an account administrator tries. What should they use?
A.IAM permission boundaries on every user
Permission boundaries limit IAM users/roles but an account admin could create new unbounded principals; they do not constrain the account itself.
B.Service control policies (SCPs) attached to the organization or OUs
Correct. SCPs are organization-level guardrails that member accounts cannot bypass.
C.AWS Config rules in each member account
Config rules detect and can remediate noncompliance but do not prevent the action.
D.Amazon GuardDuty with threat detection enabled
GuardDuty detects threats and anomalies; it is detective, not preventive.
Why this answer
Service control policies set the maximum available permissions for accounts in an organization or OU. An SCP can deny cloudtrail:StopLogging / DeleteTrail and restrict aws:RequestedRegion, and member account administrators cannot exceed or remove an SCP.
Correct answer: B · Last reviewed 2026-10-25
Official AWS references
Practice this interactively
Answer without seeing the solution first in the IAM & Access Control practice session.
Practice IAM & Access Control