All 7 AWS Organizations & Multi Account Strategy questions
More in AWS Organizations & Multi Account Strategy
What is AWS Organizations and what benefits does it provide for managing multiple AWS accounts? Why do organizations commonly adopt a multi account strategy instead of running all workloads within a single AWS account? What are Organizational Units in AWS Organizations, and how do they help structure a large number of accounts logically? What is the AWS Landing Zone or AWS Control Tower, and how does it help set up a well architected multi account environment quickly? How can cross account IAM roles enable secure resource sharing and centralized management across accounts within an organization? How should an organization design its overall account structure and governance model to balance security isolation with developer agility and operational efficiency?
Advertisement
AWS › AWS Organizations & Multi Account Strategy

What are Service Control Policies, and how do they enforce security and compliance guardrails across an entire organization?

Intermediate

Answer

Service Control Policies, or SCPs, define the maximum available permissions for accounts within an organization or organizational unit, meaning even if an individual account's IAM policies would otherwise allow an action, an SCP can explicitly deny that action organization wide, providing a powerful centralized guardrail mechanism, such as preventing any account from disabling CloudTrail logging or launching resources outside of approved regions, regardless of what permissions individual account administrators might otherwise grant.
aws organizations create-policy --content file://deny-region-policy.json --type SERVICE_CONTROL_POLICY --name RestrictRegions
Real-world example A company applies a Service Control Policy across its entire organization that prevents any account from launching resources outside of two approved regions, ensuring compliance with data residency requirements even if an individual account administrator mistakenly tries to deploy elsewhere.

Common follow-ups: What is the difference between an SCP and a regular IAM policy in terms of what they can grant versus restrict?;What happens if an SCP conflicts with an IAM policy granting the same action?

AWS Global Infrastructure (Regions AZs & Edge Locations);IAM
All 7 AWS Organizations & Multi Account Strategy questions