A company has 10 accounts that are part of an organization in AWS Organizations. AWS Config is configured in each account. All accounts belong to either the Prod OU or the NonProd OU. The company has set up an Amazon EventBridge rule in each AWS account to notify an Amazon Simple Notification Service (Amazon SNS) topic when an Amazon EC2 security group inbound rule is created with 0.0.0.0/0 as the source. The company’s security team is subscribed to the SNS topic. For all accounts in the NonProd OU, the security team needs to remove the ability to create a security group inbound rule that includes 0.0.0.0/0 as the source. Which solution will meet this requirement with the LEAST operational overhead?
Select one answer.
Marked answer: A
Community Discussion
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
Chose A1
I have exactly this scenario in my current project and SCPs cannot evaluate the CIDR value being added inside an EC2 security group ingress rule, aws:SourceIp refers to the API caller’s source IP, so EventBridge plus Lambda remediation is the viable option.
Chose B1
Again just to be clear, there is a condition key (aws:SourceIp) for SCP, but it doesnt prevent someone from creating an ingress security group rule from 0.0.0.0/0 but instead only inspects the API Calls made and the API Caller's IP Address
1
Sorry A is the Answer. My Explanation remains the same
