Question

A company uses AWS Organizations with all features enabled. A developer's IAM user in a member account has an attached identity policy granting full access to Amazon S3 (s3:*). The account is in an OU with an SCP that allows only ec2:* and cloudwatch:* actions (no other statements, no explicit denies). The developer attempts to run s3:ListBucket. What is the result and why?

Accepted Answer

The action is denied because the SCP does not include S3 actions in its Allow list, so S3 is not permitted at the Organizations boundary.

Answer

The action is allowed because the identity policy explicitly grants s3:*, which overrides the SCP's limited Allow list.

Answer

The action is allowed because SCPs only affect the management account, not member accounts.

Answer

The action is denied only if a permission boundary is also attached to the IAM user restricting S3.