Lesson 05 — Service Control Policies (SCPs)

Learning Path

☁️ Phase 2 – AWS Cloud Security

📘 Module 03 – AWS Organizations & Multi-Account Security

🎯 Lesson Objective

By the end of this lesson, you will be able to:

Understand Service Control Policies (SCPs).
Explain how SCPs work.
Differentiate SCPs from IAM Policies.
Apply SCPs to Organizational Units.
Design enterprise governance guardrails.

📚 Lesson Information

Estimated Time: 60 Minutes

Difficulty: Intermediate

Prerequisites: Lesson 04 – Organizational Units (OUs)

Hands-on Lab: No

Assignment: No

💼 Business Value

In a large enterprise, every team should have the freedom to build cloud solutions—but within clearly defined security boundaries.

For example:

Developers should not disable CloudTrail.
Engineers should not delete security logs.
Sandbox accounts should not launch expensive GPU instances.
Production resources should not be deployed outside approved regions.

Rather than controlling every user individually, enterprises create organization-wide guardrails.

AWS provides Service Control Policies (SCPs) to enforce these guardrails.

🏢 In the Company

CloudNova Technologies now manages over 50 AWS accounts.

Different teams have AdministratorAccess within their own accounts.

During a security review, the Cloud Security Team discovered:

CloudTrail was disabled in one account.
A developer accidentally deleted an AWS Config Recorder.
Resources were deployed in an unsupported AWS Region.

Although IAM permissions were configured correctly, there were no organization-wide restrictions.

The CISO introduces Service Control Policies (SCPs) to establish mandatory security controls across the enterprise.

🌍 What is a Service Control Policy?

A Service Control Policy (SCP) is a policy used in AWS Organizations that defines the maximum permissions available to AWS accounts.

An SCP does not grant permissions.

Instead, it sets the boundaries for what IAM Users and IAM Roles are allowed to do.

Think of an SCP as a company-wide rulebook that every AWS account must follow.

🏗 How SCPs Work

AWS Organization

        │

Organizational Unit (OU)

        │

Service Control Policy

        │

AWS Account

        │

IAM Users & IAM Roles

        │

Allowed AWS Actions

IAM permissions are evaluated only if the SCP allows the action.

🎯 SCP vs IAM Policy

IAM Policy	Service Control Policy
Grants permissions	Defines maximum permissions
Applied to Users, Groups and Roles	Applied to AWS Accounts and OUs
Works inside one AWS Account	Works across AWS Organizations
Used for day-to-day access	Used for enterprise governance
Managed by Account Administrators	Managed by Organization Administrators

A useful way to remember this is:

IAM Policy = What a user can do
SCP = What an account is ever allowed to do

🏢 Enterprise Example

CloudNova allows developers to manage EC2 instances.

However, company policy states:

CloudTrail cannot be disabled.
Security Hub cannot be disabled.
IAM Users cannot be deleted.
Production resources can only be deployed in approved AWS Regions.

These restrictions are enforced using SCPs.

Even if a user has AdministratorAccess, the SCP still prevents prohibited actions.

🔒 Common SCP Use Cases

Organizations commonly use SCPs to:

Restrict AWS Regions.
Protect security services.
Prevent root user misuse.
Block expensive services.
Enforce compliance.
Restrict account-level changes.
Protect production environments.

🌎 Example Enterprise Guardrails

CloudNova applies the following SCPs.

SCP	Purpose
Deny Unsupported Regions	Restrict deployments to approved AWS Regions
Protect CloudTrail	Prevent disabling audit logs
Protect AWS Config	Prevent deleting configuration history
Restrict Root User	Limit sensitive root account actions
Sandbox Restrictions	Limit expensive services in lab accounts

These guardrails apply automatically to every account within the selected OU.

🚫 Common Mistakes

Avoid:

❌ Thinking SCPs grant permissions.

❌ Applying restrictive SCPs without testing.

❌ Applying SCPs directly to production without validation.

❌ Using SCPs instead of IAM Policies.

❌ Forgetting that SCPs affect every account in the OU.

✅ Enterprise Best Practices

Use SCPs for governance, not daily access control.
Apply SCPs to Organizational Units whenever possible.
Test SCPs in sandbox environments first.
Keep SCPs simple and well documented.
Review SCPs regularly.
Align SCPs with enterprise security policies.
Follow the Principle of Least Privilege.

🧪 Enterprise Mission 01 — Review Existing SCPs

Navigate to:

AWS Console

↓

AWS Organizations

↓

Policies

↓

Service Control Policies

Review:

Existing SCPs
Policy Names
Attached Organizational Units

Document your observations.

🧪 Enterprise Mission 02 — Design Enterprise Guardrails

CloudNova requires the following controls:

Prevent CloudTrail from being disabled.
Prevent IAM Users from being deleted.
Restrict deployments to approved AWS Regions.
Prevent deletion of security logs.

Identify which requirements should be enforced using SCPs.

🧪 Enterprise Mission 03 — Apply SCPs to Organizational Units

Recommend SCP assignments for:

Organizational Unit	Example Guardrail
Infrastructure	Protect networking and shared services
Security	Prevent modification of security services
Workloads	Restrict production deployments
Sandbox	Limit expensive resources

Explain why each OU requires different guardrails.

🧪 Enterprise Mission 04 — Governance Exercise

CloudNova plans to create 100 additional AWS accounts over the next year.

Design an SCP strategy that:

Supports business growth.
Protects enterprise security.
Maintains operational flexibility.
Reduces administrative overhead.

🏢 Enterprise Scenario

CloudNova’s Finance Team reports an unexpected increase in cloud costs.

Investigation reveals that developers launched high-end GPU instances in several sandbox accounts.

The CISO asks:

“How can we prevent this from happening again without removing developers’ administrative access?”

Recommend how Service Control Policies can enforce this requirement while allowing developers to continue working.

📊 Knowledge Check

What is a Service Control Policy (SCP)?
Does an SCP grant permissions?
Where are SCPs applied?
What is the difference between an IAM Policy and an SCP?
Why are SCPs considered governance guardrails?
Can an SCP restrict an Administrator?
Why should SCPs be tested before production deployment?
Why are SCPs commonly applied to Organizational Units?
Give three examples of enterprise SCPs.
How do SCPs improve cloud security?

📋 Lesson Completion Checklist

Task	Status
Understood Service Control Policies	☐
Compared IAM Policies and SCPs	☐
Reviewed enterprise guardrails	☐
Designed SCP strategy	☐
Completed governance exercise	☐

💡 Key Takeaways

After completing this lesson, you should understand:

Service Control Policies (SCPs) define the maximum permissions available to AWS accounts.
SCPs do not grant permissions; they establish organization-wide security guardrails.
SCPs are applied to AWS accounts and Organizational Units within AWS Organizations.
IAM permissions are effective only if they are allowed by both the IAM Policy and the applicable SCP.
SCPs are a core governance mechanism for securing enterprise AWS environments at scale.

🚀 Next Lesson

➡️ Lesson 06 — AWS Control Tower Overview