Your company has configured an AWS organization with a master account and several organization units (OU) for its various R&D departments. There is an S3 bucket owned by AWS account A that needs to be accessed by one IAM user that belongs to another AWS account
B. Account B is outside the organization. The S3 bucket policy already granted access to this account B user. In account B, the user has the IAM permissions to read the bucket. However, AWS account A has a Service Control Policy (SCP) attached to allow the bucket access only from account A users. Is the IAM user in account B able to read the files in the bucket successfully?

Answer options:

A.No, because the SCP policy takes priority and disallows the bucket access from the user in account
B.B.No, because S3 cross-accounts access can only be allowed for AWS IAM users within an AWS Organization.
C.No, the AWS organization should add a new OU for account B and then configure an SCP in the new OU to allow access to the S3 bucket.
D.Yes. Since SCP doesn`t apply to those outside users, the user in account B has the permission to access the files in the bucket.

Correct Answer – D
When the Service Control Policy (SCP) is configured, only those IAM users that are within the organization are affected. In other words, SCP does not affect users or roles if they are outside the organization. For various SCP effects on permissions, refer to https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scp.html.
Option A is incorrect: Because SCP does not affect the user in account B since it does not belong to the Organization.
Option B is incorrect: Because S3 cross-accounts access is possible as long as enough IAM permissions are granted.
Option C is incorrect: Because there is no need to allocate a new OU for account
B.Option D is CORRECT: Because the user in account B can read the files in the bucket as SCP policy does not influence it. About the details on how to copy S3 objects from another AWS account, check the AWS tutorial in
https://aws.amazon.com/premiumsupport/knowledge-center/copy-s3-objects-account/.