AWS Certified Solutions Architect - Professional Practice Mode

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose A1

  I have exactly this scenario in my current project and SCPs cannot evaluate the CIDR value being added inside an EC2 security group ingress rule, aws:SourceIp refers to the API caller’s source IP, so EventBridge plus Lambda remediation is the viable option.

• Chose B1

  Again just to be clear, there is a condition key (aws:SourceIp) for SCP, but it doesnt prevent someone from creating an ingress security group rule from 0.0.0.0/0 but instead only inspects the API Calls made and the API Caller's IP Address

• 1

  Sorry A is the Answer. My Explanation remains the same