Question

A financial services company uses AWS Organizations with a hierarchy of nested OUs. The security team attaches an SCP at the root that explicitly allows all EC2 actions. A separate SCP at the 'Production' OU explicitly denies ec2:TerminateInstances. Developers in a production account also have an IAM policy that explicitly allows ec2:TerminateInstances. A developer attempts to terminate an EC2 instance in a production account and is denied. The team wants to understand the governing behavior to design future guardrails correctly. Which statement accurately describes why the action was blocked and how SCPs interact with IAM permissions?

Accepted Answer

An explicit deny in any applicable SCP overrides all allows; SCPs only set the maximum available permissions and never grant access, so the IAM allow cannot override the SCP deny.

Answer

SCPs grant permissions to IAM principals; because the Production OU SCP does not grant ec2:TerminateInstances, the principal has no effective permission regardless of the IAM policy.

Answer

The IAM policy and the SCP are evaluated independently, so the more permissive of the two wins; the deny occurred because of a service-linked role restriction, not the SCP.

Answer

SCPs attached to a child OU are ignored when a root SCP explicitly allows the same action, so the denial was caused by a missing permissions boundary on the developer role.