A company uses AWS Organizations with a single OU named Production to manage multiple accounts. All accounts are members of the Production OU. Administrators use deny list SCPs in the root of the organization to manage access to restricted services. The company recently acquired a new business unit and invited the new unit’s existing AWS account to the organization. Once onboarded, the administrators of the new business unit discovered that they are not able to update existing AWS Config rules to meet the company’s policies. Which option will allow administrators to make changes and continue to enforce the current policies without introducing additional long-term maintenance?
Select one answer.
Marked answer: D
Community Discussion
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
Chose D1
If a lower-level policy can override a higher-level deny policy, how can you ensure every account complies with the company's policy?
Chose B1
Answer is B: Temporary OU (Onboarding) allows for a safe, isolated adjustment period Allow SCP at Onboarding OU level overrides the deny list at root (SCP evaluation logic) Root SCPs remain untouched → current policies stay in force org-wide After onboarding, move to Production OU → account falls back under root deny list SCPs Zero long-term maintenance — this is a one-time onboarding pattern
