What will happen to the permissions of the administrative 1AM roles as a result of this change?

By:
In: DOP-C02
Tagged:
With: 1 Comment
A company uses AWS Organizations to manage its AWS accounts.The organization root has a child OU that is named Department.The Department OU has a child OU that is named Engineering.The default FullAWSAccess policy is attached to the root, the Department OU, and the Engineering OU.The company has many AWS accounts in the Engineering OU.Each account has an administrative IAM role with the AdministratorAccess IAM policy attached.The default FullAWSAccessPolicy is also attached to each account.A DevOps engineer plans to remove the FullAWSAccess policy from the Department OU.The DevOps engineer will replace the policy with a policy that contains an Allow statement for all Amazon EC2 API operations.

What will happen to the permissions of the administrative 1AM roles as a result of this change?

All API actions on all resources will be allowed.

All API actions on EC2 resources will be allowed. All other API actions will be denied.

All API actions on all resources will be denied.

All API actions on EC2 resources will be denied. All other API actions will be allowed.

Explanations:

Removing the FullAWSAccess policy from the Department OU means that accounts in that OU will no longer inherit broad permissions for all actions. Therefore, the administrative IAM roles will not automatically retain permissions for all API actions.

The new policy will allow all Amazon EC2 API operations. Since the FullAWSAccess policy is being removed, the IAM roles will still have permissions granted by the AdministratorAccess policy, which includes EC2 actions. However, without the FullAWSAccess policy, they will not inherit permissions for other services, resulting in the ability to perform all EC2 operations, but no other actions.

The administrative IAM roles will still retain permissions from the AdministratorAccess policy, which allows all actions on all resources. Therefore, they will not have all actions denied.

The new policy allows EC2 API actions, and the AdministratorAccess policy also allows all actions on all resources. Hence, the administrative IAM roles will not have all EC2 actions denied; they will retain access to all resources.

2025-10-10

1 Comment

  1. Sara
    Author

    I scheme that the answer is:
    All API actions on EC2 resources will be allowed. All other API actions will be denied.

Leave a Reply

Your email address will not be published. Required fields are marked *

fifteen − 15 =