Question

A company uses AWS Organizations with a nested OU structure. The root has an SCP attached that allows all actions (FullAWSAccess). A top-level "Production" OU has an SCP that denies use of all AWS services except EC2, S3, and CloudWatch. A nested "WebApp" OU under Production has an SCP that explicitly allows RDS and EC2. An account in the WebApp OU has an IAM administrator user attempting to launch an RDS database instance. What is the effective result, and why?

Accepted Answer

The RDS action is denied because an SCP does not grant permissions and the Production OU SCP does not allow RDS in the effective allow-list across the OU hierarchy.

Answer

The RDS action is allowed because the WebApp OU SCP explicitly allows RDS, which overrides the parent Production OU restriction.

Answer

The RDS action is allowed because the IAM administrator user has full administrator permissions that take precedence over SCPs.

Answer

The RDS action is denied because the root FullAWSAccess SCP was overridden by the Production OU, removing all permissions from child accounts.