Skip to main content

Scenario answers

SCP denial​

An SCP does not grant access. Effective permission requires an IAM or resource-policy allow and no applicable explicit deny.

Cross-account StackSets​

Use organization integration where appropriate, target OUs, configure concurrency and failure tolerance, and validate on a small scope first.

Config remediation​

Use scoped Systems Manager Automation with retry, rate control, evidence, and a documented exception process.

App configuration​

Use AppConfig for validated progressive configuration deployment, not for arbitrary secret storage.