An AWS Organizations SCP blocks s3:DeleteObject citywide. A purge job’s application role policy allows s3:DeleteObject on a staging bucket. What happens?
Select an answer to reveal the explanation.
Short Explanation
Think of the SCP as a city ordinance the app’s desk policy cannot repeal. Even if the role says DeleteObject is fine, the org guardrail still blocks it. AdministratorAccess on the role does not punch through that ceiling.
Full Explanation
Service control policies constrain the maximum permissions available to principals in an account. An identity-based role policy cannot grant an action that an applicable SCP denies. Developers must recognize layered evaluation: app IAM alone does not bypass organization guardrails. AdministratorAccess does not exempt a principal from SCP limits.