Service Control Policies
A service control policy (SCP) is a rule attached to an organizational unit that caps what anyone in its accounts can do, including account administrators. The AWS Baseline attaches three SCPs to both of its OUs to hold the rules that must never be bypassed.
What it does
An SCP is a permission ceiling. It never grants access on its own; an identity still needs an IAM policy that allows an action. The SCP filters that allowance: if the SCP denies an action, no policy in the account can make it work. SCPs apply to every identity in a member account, including the root user, but they do not apply to the management account. AWS allows five SCPs per OU, including the default FullAWSAccess policy.
How BuiltForProd uses it
modules/organizations/scps.tf defines six logical rules and merges them into three policy documents, so the OUs stay under the five-policy limit. All three attach to the core and plat OUs created by AWS Organizations.
| Policy | What it denies | Why |
|---|---|---|
acme-security-guardrails | Creating IAM users, login profiles and access keys; deleting an S3 public access block; modifying one, except by platform automation and SSO roles; any action without MFA by a principal that is not an SSO session, an acme-* automation role, a service-linked role, root or a role tagged mfa-exempt=true | No long-lived credentials, no public S3, MFA for every human |
acme-region-restriction | Every action outside allowed_regions, with global services such as IAM, Organizations, Route 53, CloudFront and STS exempted | Nothing runs in a region the organization does not operate |
acme-audit-protection | cloudtrail:StopLogging, DeleteTrail, UpdateTrail; config:StopConfigurationRecorder, DeleteConfigurationRecorder, DeleteDeliveryChannel (root exempt) | Evidence that an administrator can switch off is not evidence |
allowed_regions is not typed by hand. The Organizations unit builds it from the home region in common.hcl, every region that has folders in the repository, and us-east-1, which stays open because the state bucket and CloudFront certificates live there. Adding a region folder therefore opens that region in the SCP.
The MFA rule is why every automation role in the platform carries the tag mfa-exempt = true: deployer roles, the secrets syncer, the SSM and Route 53 cross-account roles, runners and Lambda functions. Without the tag, the DenyUntrustedPrincipals statement blocks their calls.
The SCPs do not apply to core-root. That is deliberate: the management account is kept for Organizations and billing only, and human access there is limited to Platform Leads.
Terms you will see
| Term | Meaning |
|---|---|
FullAWSAccess | The default SCP AWS attaches; it allows everything and the custom SCPs restrict from there. |
| Deny statement | An SCP rule that blocks listed actions; explicit deny always wins. |
NotAction | A statement that applies to every action except the ones listed; used for the global-service exemption. |
| Condition key | A test on the request, such as aws:MultiFactorAuthPresent or aws:RequestedRegion. |
mfa-exempt tag | The tag that marks a role as allowed to act without MFA under the guardrails SCP. |
allowed_regions | The computed list of regions the region-restriction SCP permits. |
Where to read more
- AWS Baseline overview for the account structure the SCPs protect.
- IAM for the roles that operate under these ceilings.
- CloudTrail and AWS Config for the services the audit-protection policy guards.