Question

A large enterprise uses AWS Organizations with all features enabled. The security team has attached an SCP to an OU that denies the ec2:RunInstances action unless the request includes an instance type of t3.micro or t3.small. In one account within that OU, a developer has an IAM role with a policy that explicitly allows ec2:RunInstances for all instance types, and there is no permission boundary attached to the role. When the developer attempts to launch a t3.large instance, what is the result and why?

Accepted Answer

The launch is denied because an SCP sets the maximum available permissions, and even an explicit IAM Allow cannot grant permissions the SCP does not permit.

Answer

The launch succeeds because the IAM identity-based policy explicitly allows ec2:RunInstances for all instance types, overriding the SCP.

Answer

The launch succeeds because SCPs only apply to the management account and do not affect member accounts in the OU.

Answer

The launch is denied because a permission boundary is required for the SCP to take effect, and its absence causes an implicit deny.