An organization uses AWS Organizations with a root OU and a child OU. The root OU's SCP allows all actions on all resources. The child OU's SCP allows all DynamoDB and Lambda actions and denies all other actions. There is an account named vendor-data in the child OU. An IAM user in that account has the AdministratorAccess IAM policy but receives AccessDenied when attempting to launch an EC2 instance. What change should be made so the IAM user can launch EC2 instances in the vendor-data account?

The correct answer is to modify the child OU SCP to also allow all EC2 actions. Service Control Policies (SCPs) define the maximum available permissions for all accounts within an OU, including the root account. Since the child OU's SCP explicitly denies all actions except DynamoDB and Lambda, any attempt to perform EC2 actions, even by an IAM user with AdministratorAccess, will be denied. Modifying this SCP to include EC2 actions will permit those actions within the child OU and its accounts. Attaching AmazonEC2FullAccess to the IAM user is insufficient because SCPs override IAM policies. Creating a new SCP and attaching it to the vendor-data account is not possible; SCPs are applied at the OU level, not directly to individual accounts. Creating a new SCP and attaching it to the root OU would not resolve the issue, as the more restrictive child OU SCP would still apply and deny the EC2 actions.