A company uses an organization in AWS Organizations to manage its AWS accounts.

Service Control Policies (SCPs) are applied at the AWS Organizations level to manage what permissions are available across accounts. SCPs do not grant permissions themselves but restrict them.

In this case, the existing SCP denies resource sharing with external accounts across the organization. To allow an exception for the marketing team, the correct solution is to edit the existing SCP and apply a Condition that excludes the marketing team’s account. This is typically done using the StringNotEquals condition with the aws:PrincipalAccount or aws:PrincipalOrgID key.

By using a condition statement, you can tailor the SCP to deny access only to accounts other than the marketing account. This method ensures granular control without having to restructure the Organizational Unit (OU) or write an entirely separate policy.

Reference from AWS Certified Security - Specialty Official Guide:

This scenario is covered under the Identity and Access Management domain, where SCP exceptions and conditions are used to precisely control permission inheritance across accounts in an organization.