Understanding AWS Service Control Policies (SCPs) in AWS Organizations

As organizations grow and adopt cloud technologies, managing access and ensuring compliance across multiple accounts becomes increasingly complex. AWS Organizations, a service that allows you to centrally manage and govern multiple AWS accounts, provides a powerful feature called Service Control Policies (SCPs) to help you enforce governance at scale.
AWS Service Control Policies (SCPs) are a powerful tool for managing permissions and enforcing governance across your AWS environment. By using SCPs effectively, you can ensure that your organization remains secure, compliant, and well-managed as you scale your cloud operations. Whether you’re restricting access to specific services, enforcing compliance standards, or managing permissions across multiple accounts,
In this blog, we’ll explore what SCPs are, how they work, and why they are essential for managing your AWS environment.

What Are Service Control Policies (SCPs)?

Service Control Policies (SCPs) are a type of policy in AWS Organizations that allow you to define and enforce permissions for AWS accounts within your organization. SCPs act as guardrails, specifying the maximum permissions that accounts in an organizational unit (OU) or the entire organization can have. They do not grant permissions themselves but instead restrict what actions can or cannot be performed, even if permissions are granted at the account level.

Think of SCPs as a way to set boundaries for what is allowed in your AWS environment. For example, you can use SCPs to ensure that no account in your organization can delete critical resources, use specific regions, or access certain AWS services.

How Do SCPs Work?

SCPs are applied at the organizational level and are evaluated alongside Identity and Access Management (IAM) policies. Here’s how they work:

• Hierarchy of Application: SCPs can be attached to the root of your organization, specific organizational units (OUs), or individual accounts. Policies applied at a higher level (e.g., the root) cascade down to all child OUs and accounts.
• Deny by Default: SCPs operate on a "deny by default" principle. If an action is not explicitly allowed by the SCP, it is implicitly denied, even if an IAM policy grants the action.
• No Direct Permissions: SCPs do not grant permissions. They only define the maximum permissions that can be granted by IAM policies. For example, if an SCP denies access to a service, no IAM policy can override that denial.
• Policy Evaluation: When a user or role attempts to perform an action, AWS evaluates the SCPs attached to the account, the IAM policies, and any resource-based policies. If the action is not allowed by the SCP, it is denied.

Why Use SCPs?

SCPs are a critical tool for organizations that need to enforce governance and compliance across multiple AWS accounts. Here are some key benefits:

• Centralized Control: SCPs allow you to manage permissions across all accounts in your organization from a single location, reducing the risk of misconfigurations.
• Enforce Compliance: You can use SCPs to enforce compliance with organizational policies, such as restricting the use of certain AWS regions or services.
• Limit Risk: By restricting access to sensitive services or actions, SCPs help reduce the risk of accidental or malicious changes to your AWS environment.
• Simplify Management: SCPs make it easier to manage permissions across multiple accounts by applying consistent policies at the OU or organizational level.

Use Cases for SCPs

In this use case we will look at SCP to deny member accounts from leaving the organization, this policy will be applied at Root OU of the AWS Organization, and also another SCP to deny user from creating console login access in a member account, this policy will be applied a Compliant OU level( which is a child ou of the root).

{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Deny",
        "Action": "organizations:LeaveOrganization",
        "Resource": "*"
      }
    ]
  }

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": [
        "iam:CreateLoginProfile"
      ],
      "Resource": "arn:aws:iam::*:user/*"
    }
  ]
}

Kindly check out the repo for detailed code for setting up the SCP's at different OU levels and unit testing of each attached policies. https://github.com/olawaleade/aws_scp_automation