Play free

Security World 2 · Guardrails Above · Stage 1

Fence the Org

A fence around every account: SCPs inherited down the tree, never granting, and two accounts they do not touch.

  • SCPs
  • Inheritance
  • Deny lists and allow lists
  • aws:RequestedRegion
  • Management account exemption
Domain
Security
World
Security World 2: Guardrails Above (Professional)
Game type
Policy stepper: Edit identity, resource and key policies; the matrix shows the gate that decided.
Time
About 20 minutes on a first attempt (estimated)
Exam guides
  • SAA-C03Task 1.1: Design secure access to AWS resources
  • SOA-C03Skill 4.1.3: Implement multi-account strategies securely (for example, AWS Organizations, service control policies, IAM Identity Center); Skill 4.1.5: Enforce compliance requirements and continuous monitoring
  • DEA-C01Skill 4.5.3: Implement data privacy strategies to prevent backups or replications of data to disallowed AWS Regions
  • SAP-C02Task 1.4: Design a multi-account AWS environment
  • DOP-C02Task 6.1: Implement techniques for identity and access management at scale
  • SCS-C03Skill 6.1.1: Deploy and configure organizations by using AWS Organizations; Skill 6.1.3: Implement organization policies to manage permissions (for example, SCPs, RCPs, AI service opt-out policies, declarative policies)