> For the complete documentation index, see [llms.txt](https://awsinpractice.itassist.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://awsinpractice.itassist.com/study-group/aws-certified-solutions-architect-associate/domain-1-design-secure-architectures/copy-of-task-statement-1.1-design-secure-access-to-aws-resources/service-control-policies-scps-1.md).

# Service Control Policies (SCPs)

**Enforcing Guardrails with Service Control Policies (SCPs)**

Service Control Policies (SCPs) are organization-wide policies that help enforce governance and security controls across multiple AWS accounts in an AWS Organizations setup.

**Key Characteristics of SCPs**

* SCPs do not grant permissions but instead restrict actions that IAM Roles, IAM Users, and AWS Root Users can perform.
* SCPs apply at the AWS Organizations level, meaning they affect all IAM identities (users, roles, and groups) in an account.
* SCPs can be applied to AWS Accounts, Organizational Units (OUs), or the Root Organization.
* SCPs do not override IAM permissions, but they act as guardrails to prevent unauthorized actions.

Think of SCPs as a "deny by default" framework that ensures certain actions are always blocked—even if an IAM policy allows them.

* **SCPs restrict what AWS accounts can do** (even if an IAM Role has permissions).
* **Best Practice:** SecureCart uses **SCPs to block high-risk actions**.

**Example SCP: Deny Deletion of IAM Roles**

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": "iam:DeleteRole",
      "Resource": "*"
    }
  ]
}
```

Now, no one in SecureCart's AWS accounts can delete IAM Roles—even if their IAM Role allows it.

### **How SCPs Work with AWS Organizations & IAM**

* SCPs are attached to AWS Organizations' Root, OUs, or AWS Accounts.
* They do NOT grant permissions—only restrict actions.
* If an SCP explicitly denies an action, IAM Users and Roles in the account cannot perform it, even if an IAM Policy allows it.

**SCP vs. IAM Policies**

| **Feature**                    | **Service Control Policies (SCPs)**                         | **IAM Policies**                        |
| ------------------------------ | ----------------------------------------------------------- | --------------------------------------- |
| **Applies To**                 | AWS Accounts, Organizational Units (OUs), Root Organization | Individual IAM Users, Groups, and Roles |
| **Grants Permissions?**        | ❌ No                                                        | ✅ Yes                                   |
| **Restricts Actions?**         | ✅ Yes                                                       | ✅ Yes                                   |
| **Overrides IAM Permissions?** | ✅ Yes (Denies take precedence)                              | ❌ No                                    |
| **Used For**                   | Organizational-wide security control                        | Assigning permissions to users & roles  |

**Best Practice:** Use **SCPs for high-level security enforcement** and **IAM Policies for detailed permissions.**

***

## **SCP Use Cases in SecureCart**

SecureCart uses SCPs to enforce **security, compliance, and governance controls** across multiple AWS accounts.

* **Example 1: Deny Root User Access to All Accounts**
  * **Why?** Prevent security risks by ensuring the Root User cannot perform any action.
  * **Result:** Even if the Root User tries to create IAM Users or change policies, they are blocked
* **Example 2: Prevent Developers from Modifying IAM Policies**
  * **Why?** Developers should not modify IAM Roles or Policies, even if they have broad permissions.
  * **Result:** Developers cannot change IAM permissions, even if an IAM Role grants them access.
* **Example 3: Require All AWS Accounts to Enable Security Services**
  * **Why?** Ensure that AWS Security Hub, GuardDuty, and AWS Config remain enabled for compliance.
  * **Result:** No one can disable security monitoring in SecureCart AWS accounts.

***

### **How SecureCart Implements SCPs Across OUs**

SecureCart applies SCPs **at the Organizational Unit (OU) level** to enforce best practices.

📌 **SecureCart AWS Organizations SCPs by OU**

| **OU Name**           | **SCP Applied**                                          |
| --------------------- | -------------------------------------------------------- |
| **Security OU**       | Prevent disabling GuardDuty & Security Hub               |
| **Workloads OU**      | Restrict developers from modifying IAM policies          |
| **Infrastructure OU** | Deny creation of new VPCs outside the networking account |
| **Sandbox OU**        | Block access to production resources                     |

**Result:** SCPs prevent misconfigurations and enforce compliance across all AWS accounts.

***

### **SCP Best Practices**

*  **Apply SCPs at the OU Level**, not the account level, for better scalability.
* **Use SCPs to enforce security & compliance**, not for day-to-day permission management (use IAM for that).
* **Test SCPs in a non-production OU before applying them org-wide.**
* **Combine IAM Identity Center (AWS SSO) with SCPs** for a secure and scalable multi-account architecture.

AWS SCPs help SecureCart enforce organization-wide security while IAM Identity Center manages user access.

***

## **Summary: How SCPs Improve Security in Multi-Account AWS Environments**

| **Feature**                   | **SCP Use Case**                            | **SecureCart Example**                |
| ----------------------------- | ------------------------------------------- | ------------------------------------- |
| **Prevent Root User Access**  | Block all root account actions              | Root users cannot modify resources    |
| **Restrict IAM Permissions**  | Stop unauthorized IAM policy changes        | Developers cannot modify IAM          |
| **Enforce Security Services** | Require GuardDuty, Security Hub, AWS Config | Security tools remain enabled         |
| **Control Network Changes**   | Prevent accidental VPC creation             | Only the networking team manages VPCs |
| **Limit Billing Access**      | Block non-finance users from AWS Billing    | Only finance can manage AWS Budgets   |

**SCPs enforce security guardrails without replacing IAM permissions.**

***

## **How SecureCart Secures Multi-Account Access**

| **Security Mechanism**                       | **Purpose**                                          | **AWS Services Used**                  |
| -------------------------------------------- | ---------------------------------------------------- | -------------------------------------- |
| IAM Identity Center (SSO)                    | Centralized user authentication & access management  | IAM Identity Center, AWS Organizations |
| IAM Identity Center Groups & Permission Sets | Assign permissions to users in multiple AWS accounts | IAM Identity Center, IAM Roles         |
| Cross-Account IAM Roles                      | Grant services access across accounts securely       | IAM Roles, AWS STS                     |
| Service Control Policies (SCPs)              | Restrict actions across AWS accounts                 | AWS Organizations, SCPs                |