Multi-Account Governance — AWS Security Specialty (SCS-C03)
Policy Enforcement Scope Decides the Correct Service
AWS Organizations SCPs deny actions at the account boundary — they cannot grant permissions. Control Tower adds landing zone automation and guardrails on top of Organizations. IAM Identity Center handles federated identity across accounts. AWS Config with aggregators provides cross-account compliance visibility. The SCS-C03 tests whether you can match the governance requirement to the correct enforcement layer. An SCP prevents an account from disabling GuardDuty. A Config rule detects when it's already disabled. Those are different controls solving different problems.
What This Pattern Tests
The exam describes a multi-account environment and tests governance controls. AWS Organizations groups accounts into OUs. SCPs on OUs set maximum permission boundaries — they deny, never grant. CloudTrail organization trails aggregate audit logs. AWS Config aggregator collects compliance data across accounts. RAM (Resource Access Manager) shares resources across accounts without duplication. The trap is using SCPs to grant permissions (they only restrict) or creating cross-account IAM users instead of cross-account roles (roles use temporary credentials).
Decision Axis
Governance scope determines the tool: organization-wide restriction = SCP, account-specific permission = IAM, cross-account sharing = RAM/roles, compliance visibility = Config aggregator.
Associated Traps
More Top Traps on This Exam
Decision Rules
Whether the organizational compliance monitoring requirement — detecting configuration drift against a named framework across all accounts — is satisfied by a threat-detection service (GuardDuty) or by a configuration-compliance aggregation service (AWS Config feeding Security Hub standards with a delegated administrator).
Whether AWS Config organizational rules feeding Security Hub's PCI-DSS standard (configuration-compliance monitoring) or Amazon GuardDuty (threat detection) satisfies the requirement to alert on configuration deviations against a named compliance framework across all member accounts.
Domain Coverage
Difficulty Breakdown