An organization uses AWS Organizations with service control policies (SCPs). The root SCP currently includes a restriction that affects Amazon Simple Email Service (Amazon SES). Developers belong to a group with an IAM policy that allows ses:* actions. The account is in an OU with an SCP that allows SES. Developers receive not authorized errors when accessing SES in the AWS Management Console. What change must a security engineer make so developers can access SES?

The correct answer is to remove the Amazon SES restriction from the root SCP. SCPs are evaluated hierarchically, and a deny statement at a higher level (like the root) overrides allow statements at lower levels (like OUs or IAM policies). Even though the OU's SCP allows SES and the IAM policy allows ses: actions, the root SCP's restriction creates an explicit deny, preventing access. Adding resource-based policies is incorrect because the issue is with the SCP, not a lack of permission on the resource itself. Resource-based policies would not bypass a deny from an SCP. AWS Control Tower guardrails are implemented using SCPs; therefore, removing a guardrail is effectively removing an SCP restriction, but the question specifies an existing SCP, not necessarily a Control Tower guardrail. The most direct and accurate solution is to address the root SCP.