How to Opt a Single AWS Account Back In to AWS AI Services Without Removing Your Organization-Wide Opt-Out Policy

Problem:

You previously opted your entire organization out of AWS AI services content use, either with the AWS Organizations console Opt out from all services action or an equivalent AI services opt-out policy attached to the organization root. Now you need to opt a single member account back in (for example, to test a feature or run a specific workload), while every other account remains opted out.

When you attach an account-level opt-in policy, it appears to have no effect. The account stays opted out.

Cause:

The one-click Opt out from all services policy locks the setting with "@@operators_allowed_for_child_policies": ["@@none"]. The @@none prevents any child policy, at an OU or account, from overriding the inherited value. Until you change that, a single-account opt-in is silently ignored.

Prerequisites:

• You must work from the organization's management account, or from an account registered as a delegated administrator for AI services opt-out policies. Member accounts cannot override a locked organization policy.
• The AI services opt-out policy type must be enabled for the organization. If you already opted out org-wide, it is enabled.
• Familiarity with AI services opt-out policies as declarative policies: the effective setting for an account is the merge of policies inherited from the root and any OUs, plus any policy attached directly to the account. A child policy can override an inherited setting only when the parent allows it through @@operators_allowed_for_child_policies.

Resolution:

At a high level:

1. Confirm whether your organization-wide policy blocks child overrides.
2. If it does, update the root policy so it still defaults the whole organization to optOut, but allows child policies to reassign the value.
3. Create an opt-in policy and attach it directly to the single target account.
4. Verify the effective policy on that account.

This keeps the organization-wide default unchanged (everything stays opted out) and creates one targeted exception.

Step 1: Check whether child overrides are allowed

5. Sign in to the AWS Organizations console using the management account.
6. In the navigation pane, choose Policies, then AI services opt-out policies.
7. Open the policy attached to the organization Root and review its JSON.

If you see "@@operators_allowed_for_child_policies": ["@@none"]" under "services", "default", or "opt_out_policy", child accounts are blocked from overriding. Continue with Step 2.

If those locks are not present (or are set to ["@@assign"]), child overrides are already allowed. Skip to Step 3.

Step 2: Allow child overrides at the root (only if locked)

Modify the root policy so the entire organization still defaults to opted-out, but individual accounts are permitted to opt back in.

8. In AI services opt-out policies, select the policy attached to the Root, then choose Edit policy.
9. Replace the JSON with the following. It keeps the organization-wide optOut default but changes the child-control operator from @@none to @@assign:

{
    "services": {
        "@@operators_allowed_for_child_policies": ["@@assign"],
        "default": {
            "@@operators_allowed_for_child_policies": ["@@assign"],
            "opt_out_policy": {
                "@@operators_allowed_for_child_policies": ["@@assign"],
                "@@assign": "optOut"
            }
        }
    }
}

10. Choose Save changes.

Note that, this does not change all account's opt-out policy under this Organization. Every account still remains opted out by inheritance; you have only granted permission for targeted exceptions.

Step 3: Create and attach a single-account opt-in policy

Create the policy

11. In AI services opt-out policies, choose Create policy.
12. Enter a clear Policy name, for example OptIn-AI-Services-<AccountName>.
13. In the JSON editor, paste one of the following. To opt the account in to all AI services:

{
    "services": {
        "default": {
            "opt_out_policy": {
                "@@assign": "optIn"
            }
        }
    }
}

To opt the account in to only specific services (for example, Amazon Rekognition and Amazon Q) and keep everything else opted out:

{
    "services": {
        "rekognition": {
            "opt_out_policy": {
                "@@assign": "optIn"
            }
        },
        "q": {
            "opt_out_policy": {
                "@@assign": "optIn"
            }
        }
    }
}

14. Choose Create policy.

Note: the values optIn and optOut are case-sensitive and must be entered exactly as shown, or the policy will not work.

Attach the policy to the single account.

15. Open the policy you just created and choose the Targets tab.
16. Choose Attach.
17. Select only the target AWS account, then confirm the attachment.

Because the account-level @@assign: optIn overrides the inherited optOut, only this account is opted in. All other accounts continue to inherit the organization-wide opt-out.

Step 4: Verify the effective policy

Confirm the result on the target account before considering the change complete.

Using the console:

18. In the Organizations console, choose AWS accounts, then select the target account.
19. On the account detail page, open the Policies tab and review the effective AI services opt-out policy. It should resolve the relevant services to optIn.

Using the AWS CLI:

aws organizations describe-effective-policy \
    --policy-type AISERVICES_OPT_OUT_POLICY \
    --target-id <target-account-id>

The returned document is the merged, effective policy for that account. Confirm the services you intended show optIn.

Important Notes and Limitations

• These changes must be made from the management account or a delegated administrator; member accounts cannot modify or override a locked organization policy themselves.
• Any service still pinned with "@@operators_allowed_for_child_policies": ["@@none"] at the root cannot be overridden by an account-level policy. Loosen that entry at the root first if you need to opt in to it.
• The default key represents all current and future AI services. Using default: optIn opts the account in to services AWS may add later as well; list services individually if you want tighter control.
• AI services opt-out policies support only the @@assign operator with the values optIn or optOut. The @@append, @@remove, and @@enforced_for operators are not supported.
• Some services (for example, Amazon Monitron) require additional steps beyond the opt-out policy. Review the AWS Service Terms for service-specific requirements.

Related Information

• Opt out from all supported AWS AI services
• AI services opt-out policy syntax and examples
• Understanding declarative policy inheritance