# AWS Service Control Policies (SCPs)

AWS **Service Control Policies (SCPs)** provide **organization-wide governance** and **permission boundaries** for AWS accounts within **AWS Organizations**.

#### **✅ Key Characteristics of SCPs**

* SCPs **do not grant permissions**; they only **restrict** what IAM users, roles, and groups can do.
* Applied at the **account or Organizational Unit (OU) level**, not to individual IAM users or roles.
* Useful for **compliance, security enforcement, and cost control**.

***

### **📌 Common SCP Use Cases & Examples**

#### **1️⃣ Restricting AWS Services**

**Use Case:** Prevent usage of **unauthorized AWS services** in specific AWS accounts.\
✅ Helps enforce compliance by **blocking non-approved services**.\
✅ Ensures developers only use **approved services** for workloads.

***

#### **2️⃣ Preventing IAM User & Role Creation**

**Use Case:** Ensure IAM roles and users can only be created in the **management account**.\
✅ Avoids security risks from uncontrolled IAM roles.\
✅ Prevents **unauthorized IAM role escalation** by developers.

***

#### **3️⃣ Blocking Public S3 Buckets**

**Use Case:** Prevent developers from **making S3 buckets public**, ensuring sensitive data remains secure.\
✅ Prevents **accidental exposure of S3 objects**.\
✅ Ensures **compliance with security policies** by enforcing bucket-level security.

***

#### **4️⃣ Enforcing AWS Region Restrictions**

**Use Case:** Restrict AWS resource creation to **approved regions** (e.g., only allow `us-east-1` and `eu-west-1`).\
✅ Helps with **data residency compliance** (e.g., GDPR).\
✅ Prevents unauthorized **deployment in high-cost or restricted regions**.

***

#### **5️⃣ Preventing CloudTrail Log Deletion**

**Use Case:** Ensure **audit logs remain intact** by **blocking deletion of CloudTrail logs**.\
✅ Prevents **malicious log deletion** that could cover up security incidents.\
✅ Ensures compliance with **audit and regulatory requirements**.

***

#### **6️⃣ Preventing Root User Actions**

**Use Case:** Restrict AWS **root user actions** to prevent unauthorized changes.\
✅ Enhances security by **reducing root account usage**.\
✅ Encourages **IAM role-based access control** instead of root access.

***

#### **7️⃣ Enforcing Encryption on All AWS Storage Services**

**Use Case:** Ensure **all stored data is encrypted at rest** across **S3, RDS, and EBS**.\
✅ Helps meet **compliance and security best practices**.\
✅ Ensures **data confidentiality** by enforcing encryption.

***

#### **8️⃣ Enforcing AWS Config for Compliance Monitoring**

**Use Case:** Ensure AWS Config is enabled across all accounts to track resource changes and compliance.\
✅ Helps with **security audits and compliance reporting**.\
✅ Ensures **resources are continuously monitored** for misconfigurations.

**Implementation Considerations:**

* Apply SCPs to enforce AWS Config in all accounts.
* Combine with AWS Config rules to **detect and remediate non-compliant resources**.
* Use **AWS Config Aggregator** in the **management account** to collect compliance data across all accounts.

✅ Example Scenario:\
A company wants to **enforce encryption on all S3 buckets** across its AWS Organization. They implement an AWS Config rule that checks for S3 bucket encryption and an SCP that **prevents disabling AWS Config**.

***

### **📌 Best Practices for SCP Implementation**

✅ **Apply SCPs at the Organizational Unit (OU) level** for better manageability.\
✅ **Use Allow/Deny strategically** to **enforce security while avoiding disruption**.\
✅ **Test SCPs before applying them** using the **IAM Policy Simulator**.\
✅ **Combine SCPs with IAM Policies** for **fine-grained access control**.\
✅ **Monitor SCP enforcement using AWS Organizations logs**.

***

### **📌 Common Mistakes**

❌ **Overly restrictive SCPs blocking essential services**.\
❌ **Applying SCPs without testing, leading to broken workflows**.\
❌ **Forgetting that SCPs do not grant permissions** (IAM policies are still required).\
❌ **Not applying SCPs at the Organizational Unit (OU) level**, leading to inconsistency.

***

### **📌 Summary**

🚀 **AWS Service Control Policies (SCPs) provide centralized governance for AWS accounts, enabling security, compliance, and cost management.**\
✔ **Restrict IAM role creation to prevent privilege escalation.**\
✔ **Block public S3 bucket access for data security.**\
✔ **Prevent CloudTrail deletion to ensure auditability.**\
✔ **Restrict AWS service usage to avoid unnecessary costs.**\
✔ **Enforce encryption across AWS storage services for compliance.**\
✔ **Ensure AWS Config is enabled to track compliance and security changes.**