Service Control Policies (SCPs) in AWS

In-Depth: What is Service Control Policy (SCP)?

Service Control Policies (SCPs) are a foundational security and governance feature in AWS Organizations, designed to provide centralized control over the maximum available permissions for all accounts within an AWS Organization. Introduced to address the growing complexity and risk associated with managing permissions across multiple AWS accounts, SCPs act as permission guardrails, ensuring that even the most privileged users (including root) in member accounts cannot exceed the boundaries set by the organization’s administrators. This capability is especially critical for enterprises adopting a multi-account strategy, where the need for both autonomy and control must be carefully balanced.

At their core, SCPs are JSON-based policies similar in syntax to AWS Identity and Access Management (IAM) policies, but with a key difference: SCPs do not grant permissions. Instead, they define the maximum permissions that accounts, organizational units (OUs), or the entire organization can have. Any action that is not explicitly allowed by both the SCP and the attached IAM policies is denied. This dual-layered approach enables organizations to enforce least-privilege principles at scale, prevent accidental or malicious escalation of privileges, and codify compliance requirements across all AWS workloads.

The history of SCPs is rooted in AWS’s recognition that cloud adoption at scale often leads to decentralized account management, which, while empowering teams, also increases the risk of security misconfigurations. SCPs were introduced to mitigate these risks by allowing central security teams to define organization-wide controls that cannot be bypassed at the account level. Over time, SCPs have evolved to support the full IAM policy language, including condition keys, resource-level permissions, and advanced constructs like NotAction and Deny statements, making them a powerful tool for implementing sophisticated governance models.

The primary problems SCPs solve are: enforcing compliance and security standards, reducing the blast radius of potential breaches, and enabling safe innovation by allowing account owners to operate freely within established boundaries. With features such as policy inheritance, explicit deny, and integration with AWS CloudTrail for auditing, SCPs are essential for organizations seeking to meet regulatory requirements, manage risk, and maintain operational agility in the cloud.

Architecture

Key Components

Key Capabilities

Common Use Cases

Implementation Example

import boto3

client = boto3.client('organizations')

# Example SCP: Deny creation of IAM users
scp_policy = '{\n"Version": "2012-10-17",\n"Statement": [{\n    "Effect": "Deny",\n    "Action": "iam:CreateUser",\n    "Resource": "*"\n}]}'

# Create the SCP
response = client.create_policy(
    Content=scp_policy,
    Description='Deny creation of IAM users',
    Name='DenyIAMUserCreation',
    Type='SERVICE_CONTROL_POLICY'
)
policy_id = response['Policy']['PolicySummary']['Id']

# Attach the SCP to an Organizational Unit (OU)
ou_id = 'ou-xxxx-xxxxxxxx'  # Replace with your OU ID
client.attach_policy(
    PolicyId=policy_id,
    TargetId=ou_id
)
                

This example demonstrates how to create a Service Control Policy that denies the creation of IAM users and attach it to an Organizational Unit using the AWS Python SDK (boto3). Replace ou-xxxx-xxxxxxxx with your actual OU ID.