📖 What is Service Control Policies (SCPs)?
Service Control Policies (SCPs) are organization-level policies used to manage permissions across all accounts in an AWS Organization. They define the maximum available permissions for an account, ensuring that specific actions are blocked even if IAM policies allow them.
"Focus on the 'deny' capability for the exam; an explicit deny in an SCP always overrides any 'allow' permission granted within a member account's IAM policy."
📚 Certification: AWS Certified Solutions Architect - Associate (SAA-C03)
🔑 What are the Key Concepts of Service Control Policies (SCPs)?
- ▸ SCPs act as guardrails that define the maximum available permissions for an account, but they do not grant permissions to users or roles themselves.
- ▸ An explicit deny in an SCP always overrides any allow permission granted by IAM policies, ensuring critical resources remain protected regardless of local settings.
- ▸ Policies are applied to the root, Organizational Units (OUs), or individual accounts, and permissions are inherited down the hierarchy to all child entities.
- ▸ SCPs affect all identities within a member account, including the root user, which allows administrators to restrict root access for enhanced security compliance.
- ▸ The default FullAWSAccess policy allows all actions; administrators typically add restrictive SCPs to create a 'deny-list' for specific services or regions.
🎯 How does Service Control Policies (SCPs) appear on the SAA-C03 Exam?
You may be asked to implement a restriction that prevents any user in a member account from deleting S3 buckets, even if they have AdministratorAccess IAM permissions. The correct solution involves applying an SCP with an explicit deny for s3:DeleteBucket.
A scenario might describe a need to restrict the deployment of AWS resources to specific geographic regions for compliance. Expect to identify SCPs as the tool to block all regions except the approved ones.
Expect questions about cost control where a company needs to prevent developers from launching expensive EC2 instance types across multiple accounts. You must identify SCPs as the mechanism to restrict specific API actions.
❓ Frequently Asked Questions
Do SCPs grant permissions to IAM users or roles?
No, SCPs only define the maximum permissions available. For a user to perform an action, they must have both an allowing SCP and a corresponding allow permission in their IAM policy.
How do SCPs differ from IAM permission boundaries?
SCPs are managed at the Organization level and affect the entire account, including the root user. Permission boundaries are applied to specific IAM entities within a single account.