Track issue in the SCP

Hi AWS, I am writing an SCP to enable AWS Config and AWS GuardDuty. The approved regions are us-east-1, us-east-2, us-west-1. Here is the SCP code:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "guardduty:*",
                "config:*"
            ],
            "Resource": "*",
            "Effect": "Deny",
            "Condition": {
                "StringNotEquals": {
                    "aws:RequestedRegion": [
                        "us-east-1",
                        "us-east-2",
                        "us-west-1",
                        "us-west-2"
                    ]
                }
            }
    }
    ]
}

But during testing, I tried to enable both AWS Config and GuardDuty in one of the non-approved regions (for e.g. ap-south-1) and I was able to enable it.

Can you please help me in identifying why it is happening?