A company manages accounts with AWS Organizations and has an SCP at the root to prevent sharing resources with external accounts. The marketing team’s AWS account must be allowed to share resources with external accounts, but all other accounts must remain restricted. All accounts are in the same OU. Which solution meets these requirements?

Service Control Policies (SCPs) are inherited down the organizational unit (OU) hierarchy. An SCP at the root applies to all accounts within the organization. To create an exception for a specific account while maintaining the restriction for others, you must modify the existing SCP. Adding a condition to the SCP that excludes the marketing team's account (e.g., using aws:PrincipalAccount or aws:RequestedAccount) from the "Deny" effect will allow that account to share resources, while the "Deny" statement still applies to all other accounts. Creating a new SCP in the marketing account would not override a "Deny" SCP inherited from the root, as SCPs are evaluated with an explicit "Deny" taking precedence. Editing the existing SCP to add an "Allow" statement would be less effective because explicit "Deny" statements always override "Allow" statements in SCPs. IAM permissions boundaries only restrict the maximum permissions an IAM entity can have within an account; they do not override SCPs applied at the organization level.