An IT company has owned several AWS accounts that belong to an AWS Organization. The root account and all children accounts have configured Service Control Policies (SCPs) to help manage the organization. Recently, an IAM user in a child account needs the permissions to enable its Amazon VPC Flow Logs. Under which configurations can the user operate the VPC Flow Logs successfully? (Select TWO.)

Answer options:

A.The SCP for the root account permits enabling VPC Flow Logs. The SCP for the child account does NOT permit enabling VPC Flow Logs. The user has the IAM permission policy to enable VPC Flow Logs.
B.The SCPs for both root account and the child account permit enabling VPC Flow Logs. The user has the IAM permission policy to enable VPC Flow Logs.
C.The SCP for the root account permits all actions with default FullAWSAccess policy. The user does NOT have the IAM permission policy to enable VPC Flow Logs.
D.The SCP for the root account permits all actions with default FullAWSAccess policy. The child account permits enabling VPC Flow Logs. The user has the IAM permission policy to enable VPC Flow Logs.
E.The SCP for the root account does NOT permit enabling VPC Flow Logs. The SCP for the child account permits enabling VPC Flow Logs. The user does NOT have the IAM permission policy to enable VPC Flow Logs.

Correct Answer – B, D
An SCP policy can limit the permissions for all entities in its member accounts, which means the root account policy affects all the children`s accounts. And the child account has only those permissions permitted by every parent above it.
In this case, to have the permissions to enable VPC Flow Logs, the root account SCP, the child account SCP, and IAM policy should all allow the action.
Option A is incorrect: Because the child account SCP blocks the action.
Option B is CORRECT: Because all parties allow the action according to the above.
Option C is incorrect: Because users or roles must be granted permissions using IAM permission policies even if SCP policies allow the actions.
Option D is CORRECT: Because the FullAWSAccess policy is a default one that allows everything including VPC Flow Logs.
Option E is incorrect: Because the action is blocked by the root account SCP even if the child SCP allows it.