A company wants to guarantee — across 50 accounts — that workloads run only in two approved Regions, even for account admins. Which mechanism enforces this?
A.IAM policies in every account
Account admins can modify local IAM policies — not a guardrail.
B.An SCP denying all actions outside the approved Regions, applied at the OU or org root
Correct. SCPs are the enforceable org-wide boundary.
C.CloudTrail alarms watching for API calls in other Regions
Alarms detect but don't prevent, and can be disabled.
D.A signed agreement with each account admin
Agreements aren't technical enforcement.
Why this answer
Service control policies set maximum permission boundaries across member accounts — including denying `aws:RequestedRegion` outside an allowlist. SCPs bind even account administrators; they can't be overridden locally.
Correct answer: B · Last reviewed 2026-10-26
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Multi-Account Architecture practice session.
Practice Multi-Account Architecture