Security World 2 · Guardrails Above · Stage 2

Resource Side

The same fence on the other side: an RCP caps what anyone, inside or out, may do with the organization's resources, and declarative policies set defaults without reading a request.

RCPs
aws:PrincipalOrgID
Data perimeter
Declarative policies
AI services opt-out

Domain: Security
World: Security World 2: Guardrails Above (Professional)
Game type: Policy stepper: Edit identity, resource and key policies; the matrix shows the gate that decided.
Time: About 30 minutes on a first attempt (estimated)
Exam guides: SOA-C03Skill 4.1.3: Implement multi-account strategies securely (for example, AWS Organizations, service control policies, IAM Identity Center)
SAP-C02Task 1.4: Design a multi-account AWS environment
SCS-C03Skill 6.1.3: Implement organization policies to manage permissions (for example, SCPs, RCPs, AI service opt-out policies, declarative policies)