An administrator attached a service control policy (SCP) to an organizational unit (OU) that contains AWS account 1111-1111-1111. Developers in that account report they cannot create Amazon S3 buckets. What should the administrator do to resolve the issue so developers can create buckets?

Service Control Policies (SCPs) define the maximum available permissions for an AWS account, but they do not grant permissions. If an SCP allows an action, the account's IAM identities (users, groups, roles) still need explicit IAM policies to grant those specific permissions. The developers cannot create S3 buckets because their IAM identities lack the necessary s3:CreateBucket permission. The administrator should instruct developers to add this permission to their IAM policies. Modifying the SCP to explicitly allow s3:CreateBucket would only ensure that the action isn't denied by the SCP; it wouldn't grant the permission. Removing the account from the OU or attaching the SCP directly would not resolve the underlying issue of missing IAM permissions. Removing the SCP entirely would remove all guardrails, which is not a secure or practical solution.