Which AWS Organizations feature applies permission guardrails across many AWS accounts at once?
Show answer and explanation
Answer: B
Service control policies attach to the organization root, OUs, or accounts and define the maximum permissions available to principals in member accounts. They do not grant permissions; they filter what identity policies can allow, and they apply even to account administrators. That makes them the standard guardrail for organization-wide limits such as Region restrictions or blocked services.
Why the other options are wrong
- A. Consolidated billing aggregates charges and unlocks volume discounts; it carries no permission semantics.
- C. Config rules evaluate resource configuration after the fact; they detect and can remediate but do not bound IAM permissions.
- D. Resource groups are collections of resources for management and tagging; they do not set permissions.