Tag each user that needs access to the S3 bucket. Add the aws:PrincipalTag global condition key to the S3 bucket policy. Show Suggested Answer by Rock08 at Oct. 9, 2022, 1:28 p.m. Disclaimers: - ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.- Trademarks, certification & product names are used for reference only and belong to Amazon. Comments udeHighly Voted 2 years, 9 months ago Selected Answer: A aws:PrincipalOrgID Validates if the principal accessing the resource belongs to an account in your organization. upvoted 80 times BoboChow2 years, 9 months ago the condition key aws:PrincipalOrgID can prevent the members who don't belong to your organization to access the resource upvoted 22 times NaneyerockyHighly Voted 9 months, 3 weeks ago Selected Answer: A Condition keys: AWS provides condition keys that you can query to provide more granular control over certain actions. The following condition keys are especially useful with AWS Organizations: aws:PrincipalOrgID – Simplifies specifying the Principal element in a resource-based policy. This global key provides an alternative to listing all the account IDs for all AWS accounts in an organization. Instead of listing all of the accounts that are members of an organization, you can specify the organization ID in the Condition element. aws:PrincipalOrgPaths – Use this condition key to match members of a specific organization root, an OU, or its children. The aws:PrincipalOrgPaths condition key returns true when the principal (root user, IAM user, or role) making the request is in the specified organization path. A path is a text representation of the structure of an AWS Organizations entity. upvoted 26 times Sleepy_Lazy_Coder1 year, 11 months ago are we not choosing ou because the least overhead term was use? option B also seems correct upvoted 5 times EMPERBACH1 year, 2 months ago As there are many OU, you need more effort to list down OU path. And question mention about least management overhead to allow users in Organization, not single OU. upvoted 3 times BlackMamba_41 year, 10 months ago Exactly upvoted 1 times ClouddonMost Recent 1 week, 3 days ago Selected Answer: A Use aws:PrincipalOrgID in the bucket policy for a clean, scalable, and low-maintenance solution to restrict access to AWS Organization members. upvoted 1 times K_SAA2 months ago Selected Answer: A A: use aws PrincipalOrgID global condition key with a with a reference to the organization ID to the S3 bucket policy is the correct answer because the company wants to limit access to only user within the organization. B: is also be considered since the company wanted to limit access to s3 bucket within organization not mention to specific Organizational unit. if you or the company wanted to restrict access to S3 bucket by specific OU consider option B C: use AWS cloudtrail to monitor action of users within organization, which is more complex and high operational overhead D: tag each user and use aws:PrincipalTag global condition key to the S3 bucket policy. You would have to tag each user manually, which is required more work overhead upvoted 1 times ernie19762 months, 1 week ago Selected Answer: A This solution es the most simple comparing to other alternatives, just modify one parameter. aws:PrincipalOrgID upvoted 1 times Wylla3 months, 2 weeks ago Selected Answer: A aws:PrincipalOrgID - global key provides an alternative to listing all the account IDs for all AWS accounts in an organization. upvoted 1 times