The AWS accounts in your company are managed in AWS Organizations and Organizational Units (OUs). In one AWS account, there is an S3 bucket that stores sensitive documents. The S3 bucket should only allow the AWS accounts from one OU of your Organization to get its objects. Which of the following methods is the easiest one to achieve the requirement?

Answer options:

A.In the S3 bucket policy, add all the IAM entities from the OU to the Principal field and allow read access.
B.Add the condition key “aws:PrincipalOrgPaths” in the S3 bucket policy to allow access based on the principal’s organization path.
C.Add a Service Control Policy (SCP) to the OU that allows the get object action.
D.In the S3 Access Control List, allow access for all the AWS accounts in the OU and its child OUs.

Correct Answer – B
Option A is incorrect: Because you have to fill in all the IAM entities in the OU. This option is not the easiest solution.
Option B is CORRECT: Because the condition key “aws:PrincipalOrgPaths” can check if the principal comes from the OU.
Option C is incorrect: Because SCP adds a permission boundary and you still need to use the S3 bucket policy to assign permissions.
Option D is incorrect: Because you have to set up all the required AWS accounts, and it is hard to maintain when the AWS accounts are changed in the OU. Option B is easier than this one.
Reference:
https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html
https://aws.amazon.com/blogs/security/iam-share-aws-resources-groups-aws-accounts-aws-organizations/