Intermediate LevelCloud Computing (AWS/GCP/Azure)
How do AWS Organizations and Service Control Policies (SCPs) enforce multi-account governance?
❓ Interview Prompt: Explain AWS Organizations, Organizational Units (OUs), Service Control Policies (SCPs), and maximum permission guardrails.
Managing dozens of AWS accounts individually creates governance drift. AWS Organizations centralizes multi-account management.
Service Control Policies (SCPs):
•
SCPs are Organization-level guardrails attached to AWS Accounts or Organizational Units (OUs).
•
Maximum Permission Bound: SCPs define the maximum allowable permissions for linked accounts.
•
Overriding Power: An SCP 'Deny' rule overrides all IAM permissions inside a linked account (even blocking the account Root user!).
•
Example: 'Deny' creating any resources outside 'us-east-1', or 'Deny' disabling CloudTrail.
Code Implementation Example
json
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "DenyUnapprovedRegions",
"Effect": "Deny",
"NotAction": ["iam:*", "organizations:*", "route53:*", "cloudfront:*"],
"Resource": "*",
"Condition": {
"StringNotEquals": { "aws:RequestedRegion": ["us-east-1", "eu-west-1"] }
}
}
]
}💡Service Control Policy (SCP) blocking resource creation outside approved AWS regions.
🎯 Interview Key Takeaway
Service Control Policies (SCPs) set maximum permission guardrails across AWS Organizations accounts, overriding local IAM allows.
#AWS Organizations#SCPs#Governance#Security#Intermediate
Back to all Cloud Computing (AWS/GCP/Azure) Questions→