A company has its accounts in an organization in AWS Organizations.

Service Control Policies (SCPs) in AWS Organizations act as permission guardrails, defining the maximum available permissions for IAM entities within an organization. An SCP does not grant permissions but instead limits them. When an SCP is attached to an organizational unit (OU), it restricts the permissions of all accounts within that OU.

In this scenario, the SCP explicitly denies the iam:CreateUser action. However, if the SCP does not explicitly allow other necessary actions, such as ec2:RunInstances, those actions are implicitly denied. This is because, by default, all actions are denied unless explicitly allowed in the SCP.

To resolve the issue, the SCP should be updated to include an explicit allow statement for the ec2:RunInstances action. This will permit users in the OU to launch EC2 instances while still denying the creation of IAM users.