A company is implementing AWS Organizations to restrict its developers to use only Amazon EC2, Amazon S3, and Amazon DynamoDB. The developers' account is in a dedicated OU. After applying an SCP that lists only those services, IAM users in the developers account can still use services not listed in the SCP. What should the solutions architect do to prevent developers from using services outside the policy scope?

The correct answer is to remove the FullAWSAccess SCP. By default, new accounts in an AWS Organization have the FullAWSAccess SCP attached, which allows all actions on all resources. SCPs are evaluated hierarchically, and an explicit Deny in any parent SCP will override an Allow. However, if there's an Allow at a higher level (like FullAWSAccess), it can permit actions that a more restrictive SCP intends to block. Removing FullAWSAccess ensures that only the explicitly allowed services in your custom SCP are accessible. Creating an explicit Deny statement for every AWS service is impractical and difficult to maintain as new services are released. Modifying FullAWSAccess to explicitly deny all services would block all access, including the desired services. Appending an explicit Deny with a wildcard to the end of the SCP would also deny all services, including the ones you want to allow.