Question

A company uses AWS Organizations with all features enabled. Their landing zone has a Sandbox OU (loose SCPs permitting most services), a Production OU (restrictive SCPs), and consolidated billing configured. A developer account currently in the Sandbox OU is being promoted to run a customer-facing workload and must be moved to the Production OU. The security team wants to understand the immediate effects of moving the account. Which statement correctly describes what happens when the account is moved between OUs?

Accepted Answer

The account immediately inherits the Production OU's SCPs, which take effect on new and existing API calls; existing resources remain but actions now denied by the Production SCPs will fail going forward.

Answer

The account must be removed from the organization and re-invited under the Production OU for the new SCPs to apply, temporarily severing consolidated billing.

Answer

SCPs only apply to accounts at the moment they join the organization, so the account retains its original Sandbox OU permissions until the account is recreated.

Answer

Moving the account resets its consolidated billing history and detaches it from Reserved Instance and Savings Plans sharing until manually re-enabled.