The AWS account spun up from SCV is pretty restricted in terms of the additional services which we can install in that account. Is there a document outlining the services which are not allowed in an SCV AWS account ? For example, we tried to install an Elastic Search service in the AWS account and got this error, 

=======================

Error: User: arn:aws:iam::XXXXXXXXXXXX:user/IAMLogin is not authorized to perform: es:DescribeElasticsearchDomain on resource: arn:aws:es:ap-southeast-2: XXXXXXXXXXXX:domain/emite-kinesis-connect with an explicit deny (Service: AWSElasticsearch; Status Code: 403; Error Code: AccessDeniedException; Request ID: 0a993fef-0c74-4283-9ec7-46604ace93f5; Proxy: null) IAM user or role experiencing the issue: arn:aws:iam:: XXXXXXXXXXXX:user/IAMLogin

=======================

The IAM user who performed the install, is a Full Administrator in that AWS account. Is there a way to get around this account restrictions ?