Secure Your AWS Environment with Service Control Policies
Service Control Policies (SCPs) are a powerful tool for establishing security guardrails and governance
controls across your AWS Organization.
Why Use Service Control Policies?
- Centralized Control: Define permissions guardrails that apply to all accounts. Learn more.
- Security & Compliance: Prevent undesired actions like launching resources in unapproved
regions. Examples.
- Enforce Tagging: Require specific tags on resources to improve cost allocation. Tagging Policies.
- Protect Sensitive Data: Block access to sensitive data stores and enforce encryption.
Data Protection.
Example Service Control Policies
Our SCP library contains 50+ best practice policies you can apply to your organization.
- Require the use of IMDSv2 for EC2 metadata
- Prevent use of public IPs and enforce PrivateLink
- Block public access to S3 buckets
- Prevent disabling of CloudTrail, Config, and GuardDuty
- Enforce MFA for sensitive actions
- Limit regions resources can be launched in
- Require specific tags on resources
Get Started with SCPs Today
Want access to our best practice SCP library? Join the beta by emailing
beta@servicecontrolpolicy.com.
Frequently Asked Questions
What's the difference between SCPs and IAM policies?
SCPs define the maximum available permissions for an organization, while IAM policies grant the actual
permissions to users and roles. Read more.
Do SCPs affect the management account?
No, SCPs do not affect the management account of an organization, only the member accounts. Management Account Info.
What are the best practices for using SCPs?
- Thoroughly test SCPs before applying them broadly Best Practices
- Use a deny list strategy with an "allow all" default
- Apply SCPs to Organizational Units (OUs) instead of individual accounts
- Regularly review and update SCPs using access data
How do I test and troubleshoot SCPs?
- Apply SCPs incrementally to validate impact
- Use CloudTrail to audit API calls and identify blocked actions
- Check the AWS Organizations policy evaluation logic Policy Evaluation
- Review the common policy errors in the AWS documentation Troubleshooting
