SCP
Service Control Policies
Last updated
Service Control Policies
Last updated
• Whitelist or blacklist IAM actions
• Applied at the OU or Account level
• Does not apply to the Master Account
• SCP is applied to all the Users and Roles of the Account, including Root user
• The SCP does not affect service-linked roles
Service-linked roles enable other AWS services to integrate with AWS Organizations and can't be restricted by SCPs.
• SCP must have an explicit Allow (does not allow anything by default)
• Use cases:
Restrict access to certain services (for example: can’t use EMR)
Enforce PCI compliance by explicitly disabling services
