Exam AWS Certified Solutions Architect - Associate SAA-C03 topic 1 question 488 discussion

Service Control Policies (SCP): SCPs are an integral part of AWS Organizations and allow you to set fine-grained permissions on the organizational units (OUs) within your AWS Organization. SCPs provide central control over the maximum permissions that can be granted to member accounts, including the root user. Denying Access to Billing Information: By creating an SCP and attaching it to the root OU, you can explicitly deny access to billing information for all accounts within the organization. SCPs can be used to restrict access to various AWS services and actions, including billing-related services. Granular Control: SCPs enable you to define specific permissions and restrictions at the organizational unit level. By denying access to billing information at the root OU, you can ensure that no member accounts, including root users, have access to the billing information.

but SCP do not apply to the management account (full admin power)?

SCP is for authorization

C. Create a service control policy (SCP) to deny access to the billing information. Attach the SCP to the root organizational unit (OU)

C Crt 100%

Service control policy are a type of organization policy that you can use to manage permissions in your organization. SCPs offer central control over the maximum available permissions for all accounts in your organization. SCPs help you to ensure your accounts stay within your organization’s access control guidelines. SCPs are available only in an organization that has all features enabled.

By denying access to billing information at the root OU, you can ensure that no member accounts, including root users, have access to the billing information.

c for me