Your company owns a large number of AWS accounts (1000+), and they are divided into dozens of AWS Organizations for better management. Your team owns an AWS account where an S3 bucket is created. You need to control the permissions so that only certain IAM users in one AWS Organization can read the objects in the S3 bucket. How would you configure the permissions for this S3 bucket?

Answer options:

A.In the S3 bucket policy, specify the IAM users` ARNs in the Principal field. Add a condition key aws:PrincipalOrgID to require the principal accounts to be in the organization.
B.In the Principal field of the S3 bucket policy, add the AWS Organization ARN so that its IAM users are allowed to access the S3 bucket.
C.Log in as the master account in the AWS Organization. Divide the IAM users into different Organizational Units. Use SCP in the OU to allow the read access to the S3 bucket.
D.In the AWS Management Console, add the Organization ARN in S3 -> Permissions -> Access Control List and ensure that only the read bucket permissions are allowed.

Correct Answer – A
The S3 bucket should allow the IAM users from the AWS Organization. The condition key aws:PrincipalOrgID can be added in the S3 bucket policy. An example can be found in
https://aws.amazon.com/blogs/security/control-access-to-aws-resources-by-using-the-aws-organization-of-iam-principals/.
Option A is CORRECT: The condition key aws:PrincipalOrgID can be used to check if the requesting principal belongs with the identifier specified in the policy. Please refer to
https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html.
Option B is incorrect: Because you cannot add an AWS Organization ARN in the Principal field. The following items can be specified as principals in a policy:
AWS account and root user
IAM users
Federated users (using web identity or SAML federation)
IAM roles
Assumed-role sessions
AWS services
Anonymous users (not recommended)
Option C is incorrect: Because SCP in an OU can be regarded as a permission boundary. You still need the S3 bucket policy to allow cross-account access.
Option D is incorrect: Because in the S3 Access Control List, you cannot add an Organization ARN. Check the below snapshot: