What is a service control policy in AWS Organizations?
A service control policy sets the maximum permissions for accounts in an organization or organizational unit. It never grants permissions by itself; it only limits what IAM policies in those accounts can allow, even for the root user of the member account.
Explain it simply
An SCP is the college rulebook that applies to every department. A department head can allow a student to do many things, but if the rulebook bans something, such as bringing vehicles on campus, the head's permission is useless.
Example
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "DenyOutsideIndiaRegions",
"Effect": "Deny",
"NotAction": ["iam:*", "organizations:*", "support:*"],
"Resource": "*",
"Condition": {
"StringNotEquals": {
"aws:RequestedRegion": ["ap-south-1", "ap-south-2"]
}
}
}
]
}Effective permissions are the overlap of what the SCP allows and what the IAM policy allows. If the SCP does not mention an action, it is blocked unless a broader Allow SCP exists (the default FullAWSAccess policy is attached at first).
SCPs do not apply to the management account and do not affect service-linked roles. Typical uses: restrict Regions, prevent turning off CloudTrail, block leaving the organization, and keep dev accounts from using expensive services.
What to say in the interview
"An SCP is a guardrail that caps what any identity in a member account can do, including root there. It never grants access itself. I use SCPs to block unused Regions, protect CloudTrail and enforce organisation-wide rules."
Common mistakes
- Expecting an SCP to give someone permissions.