If you remove the FullAWSAccess policy from the Development OU and attach a policy that allows all actions on EC2 resources, what is the resulting effective permission for users in the Development OU?

AWS Organizations Service Control Policies (SCPs) define the maximum available permissions for accounts within an Organizational Unit (OU). When you remove the FullAWSAccess policy, you remove the broad "allow all" permission. Attaching a new SCP that specifically allows all actions on EC2 resources means that users in the Development OU can perform any action on EC2. For any other AWS service or resource type not explicitly allowed by an SCP, the default behavior is an implicit deny. Therefore, while EC2 actions are permitted, all other API actions will be denied because no SCP grants permission for them.