An enterprise must guarantee that NO workloads — by anyone, including admins — can run in unapproved AWS regions across all member accounts. What's the enforcement mechanism?
A.IAM policies with a region condition on every role
Per-role policies can't cover every present and future principal.
B.An SCP denying actions where aws:RequestedRegion isn't an approved region, attached at the root or OU
Correct. Preventive, org-wide, applies to all principals.
C.AWS Config rules flagging resources in other regions
Detective, not preventive — resources get created then flagged.
D.GuardDuty regional monitoring
GuardDuty detects threats, not region compliance.
Why this answer
SCPs are the only mechanism that hard-caps what ANY principal (including admins) in member accounts can do — a region deny is the standard compliance pattern. IAM policies cover only the principals they're attached to; Config detects after the fact but doesn't prevent.
Correct answer: B · Last reviewed 2026-11-02
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Multi-Account Architecture practice session.
Practice Multi-Account Architecture