Question

A financial services company uses AWS Organizations with all features enabled. Security governance requires that a specific set of member accounts in the 'Sandbox' OU be prevented from creating resources except through AWS CloudFormation. The security team drafts an SCP that denies most write actions unless the calling principal is a designated automation role. However, after attaching the SCP, developers in the Sandbox OU report they can still create EC2 instances directly through the console using their own IAM roles, which have full administrator permissions. The SCP is correctly attached to the Sandbox OU. What is the MOST likely reason the SCP is not blocking these actions?

Accepted Answer

The SCP uses an Allow statement that grants the automation role permissions but does not include a Deny for other principals, so it does not restrict the developer roles.

Answer

SCPs cannot restrict actions based on the principal making the request, so the condition on the automation role is ignored entirely.

Answer

The developer IAM roles have administrator permissions, which override any SCP that is attached above them in the organization hierarchy.

Answer

SCPs do not apply to the management account, and the Sandbox OU inherits the management account's exemption.