AWS IAM · Question 12 of 12
A group allows ec2:*, and an organization service control policy denies ec2:TerminateInstances. Which statements are correct for a user of this group?
2 answers are correct. Hard Created with AI
Show answer
Answer
- A They can launch instances
- C They cannot terminate instances
Explanation
SCPs set an upper limit for all identities in an account, including root. A deny in the SCP overrides any allow in the account but only affects the action named. All other EC2 actions remain allowed by the group policy.