SAP-C02
Deep Dive
Domain D1 of the SAP-C02 carries 26% weight. Managing multiple AWS accounts is the starting point for any enterprise-scale architecture. Organizations, Control Tower, SCPs and Landing Zone are guaranteed exam topics.
Contents
AWS Organizations is the service for managing multiple AWS accounts from a master account (Management Account). It lets you apply centralized policies, consolidate billing, and establish governance guardrails at scale.
The Management Account has full access to every member account and is the only place from which Organizations is administered. It's never used for production workloads.
SCPs are JSON policies applied to OUs or individual accounts to limit the maximum permissions available in that account. They don't grant permissions — they only restrict them.
| Feature | SCPs | IAM Policies |
|---|---|---|
| Where does it apply? | To the OU or account (outer boundary) | To the IAM principal (user, role, group) |
| Does it grant permissions? | NO — it only restricts the maximum allowed | YES — grants explicit permissions |
| Does it affect root? | Does NOT affect the Management Account | YES — applies to the account's root user |
| Scope | Every action in the member account | Only the principal it's attached to |
| Typical use case | Block regions, services or org-wide actions | Grant S3 access to a specific role |
| Evaluation | Evaluated before IAM (implicit deny without an Allow SCP) | Evaluated after the SCP |
Permission evaluation logic with SCPs
AWS recommends an OU hierarchy that separates workloads by environment and function. This structure lets you apply level-specific SCPs without affecting other OUs.
Contains the Management Account. Minimal SCPs that apply to the whole org (e.g. blocking unauthorized regions, requiring MFA on root).
Centralized security accounts. Read-only access to the rest of the organization for auditing.
Shared infrastructure services consumed by every workload account.
Sub-OUs per environment. Different SCPs for prod (more restrictive) vs dev (more permissive).
AWS Control Tower
A managed service that automates setting up a multi-account Landing Zone with AWS best practices. It orchestrates Organizations, SSO, Config, CloudTrail and Service Catalog.
Landing Zone
A pre-configured multi-account environment with security and governance baked in. It's not a service — it's a reference architecture that Control Tower implements.
| Type | Mechanism | Example |
|---|---|---|
| Preventive | SCP — blocks actions that aren't allowed | "CloudTrail can't be disabled" → SCP that denies cloudtrail:StopLogging |
| Detective | AWS Config Rule — detects and alerts on non-compliance | "MFA enabled on root" → Config rule that evaluates the state |
| Proactive | CloudFormation Hook — validates before provisioning | "EC2 instances must have mandatory tags" → CloudFormation hook |
For the SAP-C02 you must understand exactly how SCPs and IAM interact. The exam presents scenarios where an administrator has broad IAM permissions but SCPs restrict them.
Scenario 1
SCP: Deny ec2:* IAM: Allow ec2:*
DENY — an explicit SCP Deny always wins
Scenario 2
SCP: Allow s3:* IAM: Deny s3:DeleteBucket
DENY on s3:DeleteBucket — an explicit IAM Deny wins
Scenario 3
SCP: Allow s3:* IAM: Allow s3:GetObject
ALLOW s3:GetObject — both allow it
Scenario 4
SCP: no Allow for ec2:* IAM: Allow ec2:*
DENY — SCP has no Allow (implicit deny)
Scenario 5
Management Account SCP: Deny ec2:*
ALLOW — SCPs don't apply to the Management Account
Scenario 6
SCP: Allow s3:* IAM: no policy attached
DENY — without an IAM Allow there's no access (SCP doesn't grant)
SCPs and resource-based policies
SCPs don't limit resource-based policies when the accessing principal belongs to another account (cross-account). A bucket policy granting access to an external account isn't subject to the SCPs of the bucket's own account — it is subject to the SCPs of the accessing principal's account.
Consolidated billing aggregates usage across every member account to calculate volume discounts and share Reserved Instance and Savings Plan benefits.
Volume discounts
AWS sums S3, EC2 data transfer, etc. usage across every account to hit discount thresholds faster.
Shared Reserved Instances
Unused RIs in one account are automatically applied to identical instances in other accounts in the org.
Shared Savings Plans
Savings Plans (Compute and EC2) are shared across the whole organization, maximizing savings.
A single bill
The Management Account receives one consolidated bill for every member account.
Payer Account vs Linked Account
Management Account (Payer)
Member (Linked) Accounts
Trap: "SCPs apply to the Management Account"
Reality: FALSE. SCPs never apply to the Management Account, even if the SCP is applied to the Root OU.
Trap: ""An SCP that allows everything guarantees access""
Reality: FALSE. The SCP only enables IAM to be able to grant the permission. Without an IAM Policy that grants it, there's no access.
Trap: "Control Tower is only for new accounts"
Reality: FALSE. Existing accounts can be brought into Control Tower using the "Enroll Account" feature.
Trap: ""A Deny in SCP can be overridden by an IAM Allow""
Reality: FALSE. An explicit Deny in an SCP is absolute. No IAM policy can override a Deny in an SCP.
Trap: "Organizations and Billing are the same thing"
Reality: Organizations is the governance service. Consolidated billing is a feature, but Organizations also manages SCPs, cross-account access and more.
Did you get this topic?
Test what you just learned
A company has 200 AWS accounts in an organization. The security team needs to guarantee that NO member account can disable AWS CloudTrail, even if that account's administrator has AdministratorAccess permissions. What is the most appropriate solution?
Put what you learned to the test with original SAP-C02 exam questions.
Start SAP-C02 mock examUnlimited mock exams with the Pro plan
Log in to track your progress.