AWS Service control policies (SCPs)

• AWS Service control policies (SCPs)
• Overview
  • Creating a new SCP
  • Editing an existing SCP
  • Applying new SCP to an OU
  • ***Note about Control Tower created SCP's

Overview

Service control policies (SCPs) are a type of organization policy that you can use to manage permissions in your organization. SCPs offer central control over the maximum available permissions for all accounts in your organization. SCPs help you to ensure your accounts stay within your organization’s access control guidelines.

• AWS Documentation for Managing SCPs
• Example SCPs

Creating a new SCP

1. Go to AWS Organizations service
2. Click on the Policies tab
3. Click on the Service control policies link
4. Click the Create policy button
5. Give the policy a name and describe the new policy
6. You can either use the interface to create the policy service by service, or you can paste in your statement directly into the policy code section on the right side of the screen
7. After you have finished with your edits, click the Create policy button in the bottom right corner

Editing an existing SCP

1. Go to AWS Organizations service
2. Click on the Policies tab
3. Click on the Service control policies link
4. Click the checkbox existing policy that you would like to edit
5. Click View details button on the right side of the screen
6. Click Edit policy button - You are not able to edit AWS created policies because they are read only
7. Make your changes and click the Save changes button in the bottom right corner

Applying new SCP to an OU

1. Go to AWS Organizations service
2. Click on the Organize accounts tab
3. Click on the OU on the left side of the screen that you want to apply the SCP
4. Expand Service control policies on the right side of the screen
5. Attach/Detach SCP's as needed. Maximum of 5 attached per OU and Maximum of 5 attached per account.

***Note about Control Tower created SCP's

Do not detach or edit aws-guardrails-XXXXXX Service Control Policies from the Organizational Units. This will create drift in the Control Tower configuration and could cause unpredictable behavior.