Question

A company uses AWS Organizations with all features enabled. A developer in a member account has an IAM policy that explicitly allows all Amazon S3 actions (s3:*). The organizational unit (OU) containing that account has an SCP attached that allows only Amazon EC2 and Amazon CloudWatch actions. When the developer tries to list S3 buckets, the request is denied. What is the correct explanation for this behavior?

Accepted Answer

An SCP defines the maximum available permissions; because the SCP does not allow S3 actions, no principal in the account can use S3 even if an IAM policy grants it.

Answer

SCPs grant permissions to principals, so the developer needs an additional SCP statement that explicitly allows the S3 action to override the IAM policy.

Answer

The IAM policy should take precedence over the SCP because identity-based policies are evaluated after service control policies.

Answer

The developer must switch to the management account, since SCPs do not apply there and S3 access will succeed automatically.