An AWS Organization with one OU runs EC2 instances in member accounts. The company needs to ensure each EC2 instance’s credentials can only be used from the specific EC2 instance they are issued to. Which SCP configuration will enforce this?
Choose an answer
Tap an option to check your answer.
Correct answer: Create an SCP that checks whether aws:EC2InstanceSourceVPC and aws:SourceVpc are the same; deny if not. Also check whether aws:EC2InstanceSourcePrivateIPv4 and aws:VpcSourceIp are the same; deny if not. Apply the SCP to the OU..
Why this is the answer
The correct SCP uses aws:EC2InstanceSourceVPC and aws:SourceVpc to ensure the request originates from the expected VPC, and aws:EC2InstanceSourcePrivateIPv4 and aws:VpcSourceIp to verify the request's private IP matches the instance's private IP. This combination effectively binds the credentials to the specific EC2 instance within its VPC, preventing their use from other instances or locations. Applying the SCP to the OU ensures consistent enforcement across all member accounts. The first incorrect option incorrectly compares aws:VpcSourceIp with a CIDR block and aws:EC2InstanceSourcePrivateIpv4 with aws:SourceVpc. The third option is less scalable due to enumerating specific VPCs and IPs and applies to individual accounts rather than the OU. The fourth option incorrectly swaps the comparison attributes for VPC and IP address.
Pass your exam — without the endless answer hunt
Get every verified question and explanation for this exam in one place, and save hours of prep. 1,000+ certifications · 20+ languages · free to start.
Pass your exam faster → No card needed