AWS Cloud Architecture•Part 5: Security, IAM, Messaging & Enterprise Deployments (51 - 65)
AWS Organizations & Service Control Policies (SCPs).
In Simple Words: SCPs define the maximum permission boundaries across all AWS accounts in your organization. An SCP never grants permissions; it acts as an immutable guardrail (e.g., forbidding member accounts from disabling CloudTrail or deleting S3 backups).
json
// SCP blocking any user/admin from leaving specified regions:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "RestrictRegions",
"Effect": "Deny",
"Action": "*",
"Resource": "*",
"Condition": {
"StringNotEquals": { "aws:RequestedRegion": ["us-east-1", "us-west-2"] }
}
}
]
}