A company has several AWS accounts managed via AWS Organizations. One of the AWS accounts has an S3 bucket that stores critical data for the company. How can you ensure that only the users in the AWS Organizations have access to this bucket?

Answer options:

A.Ensure the bucket policy has a condition that involves aws:PrincipalOrgID
B.Ensure the bucket policy has a condition that involves aws:AccountNumber
C.Ensure the bucket policy has a condition that involves aws:PrincipalID
D.Ensure the bucket policy has a condition that involves aws:OrgID

Answer: A
Option A is CORRECT because you can use a new condition key, aws:PrincipalOrgID, in IAM policies to require all principals to access the resource from an account in the organization.
Option B is incorrect because the condition in the IAM policy has to mention aws:PrincipalOrgID instead of aws:AccountNumber to allow access from individuals within your organization.
Option C is incorrect because to satisfy the ask, we should add aws:PrincipalOrgID instead of aws:PrincipalID to allow selective Principals from AWS Organization to access S3 resources.
Option D is incorrect because aws:OrgID is an invalid condition key type and would not satisfy the ask condition.
For more information on controlling access via Organizations, kindly refer to the following URL:
https://aws.amazon.com/blogs/security/control-access-to-aws-resources-by-using-the-aws-organization-of-iam-principals/