A management account administrator attaches a restrictive service control policy at the organization root and expects it to limit permissions in the management account as well. What actually happens?

Question

Accepted Answer

C. The SCP affects only member accounts and does not affect users or roles in the management account. AWS Organizations SCPs affect only member accounts in the organization. They do not affect users or roles in the management account, and this exclusion also means delegated administrator accounts that are member accounts remain subject to SCPs.

A management account administrator attaches a restrictive service control policy at the organization root and expects it to limit permissions in the management account as well. What actually happens?

Related Questions

Discussion