AWS Packer Builds Failing Due to SCP for Unencrypted Volumes Even Though Encrypted = True on Packer Build

#### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

#### Overview of the Issue

Deployed using Github Actions.

When trying to create AMIs that are not owned by Amazon, like ubuntu or RHEL. Image creations fail from an SCP that does not allow unencrypted volumes to be created or mounted to EC2 instances.

Amazon Linux 2 or Amazon Linux 2023 both deploy without any issues while the SCP is enabled.

The packer build has the "encrypted = true" set but the instance creation still fails due to the SCP. (see below)

I have added "kms_key_id" to the pakcer build but it still fails. I do not have this set on my AL2 or AL2023 packer builds, and again those deploy without any issues.

If I disable the SCP or allow an exception for the role being used by packer, instance and packer build deploy successfully.
```
Run echo "Building Packer template: aws/golden_images/ubuntu_2404/packer_ubuntu_24_04.pkr.hcl"
echo "Building Packer template: aws/golden_images/ubuntu_2404/packer_ubuntu_24_04.pkr.hcl"
packer init -upgrade "aws/golden_images/ubuntu_2404/packer_ubuntu_24_04.pkr.hcl"
packer build -color=false \
-var "region=us-east-1" \
-var "subnet_id=subnet-01234567890" \
-var "source_ami_name=ubuntu/images/hvm-ssd-gp3/ubuntu-noble-24.04-amd64-server-20250731" \
"aws/golden_images/ubuntu_2404/packer_ubuntu_24_04.pkr.hcl"
shell: /usr/bin/bash -e {0}
env:
ROLE_GITHUB_ACTIONS: arn:aws:iam::9876543210:role/packer-p-oidc-github
ASSUME_ROLE: arn:aws:iam::9876543210:role/packer-iac-execution-role
AWS_DEFAULT_REGION: us-east-1
AWS_REGION: us-east-1
AWS_ACCESS_KEY_ID: ***
AWS_SECRET_ACCESS_KEY: ***
AWS_SESSION_TOKEN: ***
SUBNET_ID: subnet-01234567890
SOURCE_AMI_NAME: ubuntu/images/hvm-ssd-gp3/ubuntu-noble-24.04-amd64-server-20250731
Building Packer template: aws/golden_images/ubuntu_2404/packer_ubuntu_24_04.pkr.hcl
Installed plugin github.com/hashicorp/amazon v1.3.10 in "/home/runner/.config/packer/plugins/github.com/hashicorp/amazon/packer-plugin-amazon_v1.3.10_x5.0_linux_amd64"
==> amazon-ebs.packer-ubuntu-2404: Prevalidating any provided VPC information
==> amazon-ebs.packer-ubuntu-2404: Prevalidating AMI Name: packer-ubuntu-2404-1755187212
==> amazon-ebs.packer-ubuntu-2404: Found Image ID: ami-0ca5a2f40c2601df6
==> amazon-ebs.packer-ubuntu-2404: Creating temporary keypair: packer_689e080c-f51b-62a0-9ebc-3a406b8b0db7
==> amazon-ebs.packer-ubuntu-2404: Creating temporary security group for this instance: packer_689e080d-311d-3d95-77b2-e60557b50337
==> amazon-ebs.packer-ubuntu-2404: Checking current host's public IP...
==> amazon-ebs.packer-ubuntu-2404: Current host's public IP: 123.45.67.890
==> amazon-ebs.packer-ubuntu-2404: Authorizing access to port 22 from [123.45.67.890/32] in the temporary security groups...
==> amazon-ebs.packer-ubuntu-2404: Launching a source AWS instance...
==> amazon-ebs.packer-ubuntu-2404: changing public IP address config to true for instance on subnet "subnet-01234567890"
==> amazon-ebs.packer-ubuntu-2404: Error launching source instance: UnauthorizedOperation: You are not authorized to perform this operation. User: arn:aws:sts::9876543210:assumed-role/packer-iac-execution-role/packer-build-iac-role-assume is not authorized to perform: ec2:RunInstances on resource: arn:aws:ec2:us-east-1:9876543210:volume/* with an explicit deny in a service control policy. Encoded authorization failure message: [encoded scp message]
==> amazon-ebs.packer-ubuntu-2404: status code: 403, request id: 2eb0941f-9498-4d81-bec4-45a6f31c16e0
==> amazon-ebs.packer-ubuntu-2404: No volumes to clean up, skipping
==> amazon-ebs.packer-ubuntu-2404: Deleting temporary security group...
==> amazon-ebs.packer-ubuntu-2404: Deleting temporary keypair...
Build 'amazon-ebs.packer-ubuntu-2404' errored after 2 seconds 795 milliseconds: Error launching source instance: UnauthorizedOperation: You are not authorized to perform this operation. User: arn:aws:sts::9876543210:assumed-role/packer-iac-execution-role/packer-build-iac-role-assume is not authorized to perform: ec2:RunInstances on resource: arn:aws:ec2:us-east-1:9876543210:volume/* with an explicit deny in a service control policy. Encoded authorization failure message: [encoded scp message]
status code: 403, request id: 2eb0941f-9498-4d81-bec4-45a6f31c16e0

==> Wait completed after 2 seconds 796 milliseconds

==> Some builds didn't complete successfully and had errors:
--> amazon-ebs.packer-ubuntu-2404: Error launching source instance: UnauthorizedOperation: You are not authorized to perform this operation. User: arn:aws:sts::9876543210:assumed-role/packer-iac-execution-role/packer-build-iac-role-assume is not authorized to perform: ec2:RunInstances on resource: arn:aws:ec2:us-east-1:9876543210:volume/* with an explicit deny in a service control policy. Encoded authorization failure message: [encoded scp message]
status code: 403, request id: 2eb0941f-9498-4d81-bec4-45a6f31c16e0
```
#### Reproduction Steps

1. Set the following SCPs -
```
{
"Sid": "PreventUnencryptedEBSVolumes",
"Effect": "Deny",
"Action": [
"ec2:CreateVolume"
],
"Resource": "*",
"Condition": {
"Bool": {
"ec2:Encrypted": "false"
}
}
},
{
"Sid": "PreventUnencryptedEBSVolumeAttachment",
"Effect": "Deny",
"Action": [
"ec2:RunInstances"
],
"Resource": "arn:aws:ec2:*:*:volume/*",
"Condition": {
"Bool": {
"ec2:Encrypted": "false"
}
}
}
```
2. Run packer build git action from an approved role.
3. Github returns deined by SCP.

### Packer version

packer_1.14.1_linux

### Simplified Packer Template
```
packer {
required_plugins {
amazon = {
version = " >= 1.3.8"
source = "github.com/hashicorp/amazon"
}
}
}

variable "region" {
type = string
default = ""
}

variable "subnet_id" {
type = string
default = ""
}

variable "source_ami_name" {
type = string
default = ""
}

source "amazon-ebs" "packer-rhel-v10" {
region = var.region
subnet_id = var.subnet_id

instance_type = "t3.small"
ssh_username = "ec2-user"
temporary_security_group_source_public_ip = true

source_ami_filter {
filters = {
name = "RHEL-10*_HVM-*x86_64*"
virtualization-type = "hvm"
root-device-type = "ebs"
}
owners = ["309956199498"]
most_recent = true
}

ami_name = "packer-rhel-v10-{{timestamp}}"
ami_description = "Red Hat Enterprise Linux 10 - updated by packer"

tags = {
Name = "golden-rhel-v10"
source_ami_name = var.source_ami_name
built_by = "packer"
team = "packer-Managed"
purpose = "Demo"
}

launch_block_device_mappings {
device_name = "/dev/xvda"
volume_size = 20
volume_type = "gp3"
delete_on_termination = true
encrypted = true
kms_key_id = "alias/aws/ebs"
}

metadata_options {
http_tokens = "required"
http_endpoint = "enabled"
}

associate_public_ip_address = true
}

build {
sources = ["source.amazon-ebs.packer-rhel-v10"]

provisioner "shell" {
inline = [
"sudo yum update -y",
"sudo dnf install -y python3",
"sudo dnf install -y https://s3.amazonaws.com/ec2-downloads-windows/SSMAgent/latest/linux_amd64/amazon-ssm-agent.rpm",
"sudo systemctl enable amazon-ssm-agent",
"sudo systemctl start amazon-ssm-agent"
]
}
}
```
### Operating system and Environment details

Latest RHEL v10 AMI