問題文
An organization onboarded at the organization scope but excluded several accounts. A colleague is surprised to find that identity roles still exist in the excluded accounts. Why is that expected?
選択肢
- Exclusions only take effect after the next full discovery pass, so the roles disappear on their own once that pass has finished walking the organization.
- The roles are left behind from a previous onboarding attempt and have to be removed by hand, because a correctly executed exclusion always removes any role that was already present in the excluded account during the same deployment run.
- The exclusion was applied at the region level rather than the account level, which leaves every account in the excluded region carrying the role.
- Exclusions prevent scanning and discovery, but the deployment mechanism still propagates the role to the accounts in the deployment scope.