SCP (service control policy)

An organization-wide guardrail that sets the most any identity in an account may do.

Think of it as: The building's rules. Your lease can't give you permission to break them.

What to know for Level 0

An SCP never grants anything. It sets the most an account may do; an IAM policy (or a resource policy) must still allow the request, or it's implicitly denied.
SCPs apply to every user and role in a member account, root included. They never apply to the management account or to service-linked roles.
An SCP is a preventive guardrail: a Deny in an SCP blocks the call before it happens, for everyone in the account. Use one when something must never be possible, like stopping CloudTrail or using an unapproved Region. Attached at the organization's root, it covers every member account, including future ones.

More detail

SCPs never grant permissions. A request needs the SCPs and an IAM policy to allow it, and an explicit Deny in either wins. SCPs apply to every user and role in a member account, including its root user, but never to the management account or to service-linked roles.

Quiz yourself on SCP (service control policy) →

← All terms