Question

A financial services company uses AWS Organizations with a restrictive SCP applied at the root that denies all IAM actions matching "iam:*Role*" except for a small set of approved administrators identified by a specific IAM path. After deploying the SCP, application teams report that Auto Scaling groups fail to launch instances and that enabling Amazon GuardDuty in member accounts now fails. Both features previously worked. The security team confirms the accounts have valid execution roles. What is the most likely cause and the correct remediation?

Accepted Answer

The SCP is inadvertently blocking creation of service-linked roles; modify the SCP to include a condition that exempts actions where iam:AWSServiceName is present or use aws:PrincipalArn conditions that allow the service-linked role creation calls.

Answer

SCPs cannot affect service-linked roles at all, so the real problem is a missing trust policy; recreate the execution roles with a corrected trust relationship in each member account.

Answer

The management account is also affected by the SCP; move the SCP to an OU that excludes the management account and the problem will resolve automatically for all member accounts.

Answer

GuardDuty and Auto Scaling require the SCP to be an allow-list (Allow) policy rather than a deny statement; replace the deny statement with an explicit Allow for iam:CreateServiceLinkedRole.