3.4.1.4. Organizational SCPs

First Principle: Establishing preventative guardrails at the highest level defines the maximum available permissions for all IAM users and roles within the affected accounts.

In large-scale AWS environments, maintaining consistent security and compliance across numerous accounts is a significant challenge. This is where Organizational Service Control Policies (SCPs) become indispensable, embodying this principle.

SCPs are powerful policy types that you can attach to an AWS Organizations root, an Organizational Unit (OU), or individual AWS accounts. Their fundamental purpose is to define the maximum available permissions for all IAM users and roles within the affected accounts. This means an SCP can explicitly deny actions, and this denial overrides any other permissions, including those granted by IAM policies.

Key characteristics and practical relevance of SCPs:

• Preventative Controls: SCPs act as hard boundaries. For instance, you can deny access to specific AWS Regions (e.g., Deny * from "us-east-1"), or restrict high-risk services like iam:DeleteUser across all accounts.
• Inheritance: Policies apply to OUs and accounts hierarchically. This simplifies management and ensures consistent enforcement.
• Centralized Governance: Managed directly from the master account in AWS Organizations, SCPs provide a single point of control for enterprise-wide security policies, enforcing encryption requirements or preventing resource deletion.

Scenario: A large enterprise needs to ensure that no developer can create or modify resources in certain AWS Regions (e.g., ap-southeast-2) or launch unapproved EC2 instance types across any development account. These restrictions must be organization-wide and absolute.

Reflection Question: How would you use Organizational Service Control Policies (SCPs) within AWS Organizations to establish preventative guardrails at the highest level, defining the maximum available permissions for all IAM users and roles in affected accounts?

SCPs are crucial for enforcing security guardrails, ensuring that even if an IAM user or role has an explicit Allow permission, an SCP can still prevent the action if it falls outside the organization's defined boundaries.

💡 Tip: Remember that SCPs do not grant permissions; they only filter the maximum permissions available. All identities within an account are subject to the SCPs applied to that account, regardless of their individual IAM policies.