Asterrr's Handbook
4 · Identity and access management

Organization policies and data perimeters

SCPs, RCPs, declarative policies and AI services opt-out policies in AWS Organizations, what each can and can't restrict, and how they combine into identity, resource and network perimeters.

Exam tasks: 4.2 (Skills 4.2.1 authorization controls and cross-account resource policies, 4.2.3 least privilege), 6.1 (central governance across accounts, see multi-account strategy)

The decision: is the guardrail about what your principals may do, who may reach your resources, or how a service is configured, and which organization policy enforces that at scale?

Choosing the policy type

SCPRCPDeclarative policyAI services opt-out
Applies toIAM users and roles (and root) in member accountsResources in member accounts, whoever callsService configurationContent use by AI services
Grants anythingNoNon/an/a
Enforced atAuthorization of each API callAuthorization of each API callThe service's control planeService behaviour
Affects the management accountNoNoApplies to accounts it's attached toApplies to accounts it's attached to
Affects service-linked rolesNoNoYesn/a
ExampleDeny leaving the org, deny disabling GuardDutyDeny access from outside the org to S3, KMS, Secrets ManagerBlock public AMIs, IMDSv2 by defaultOpt the whole org out of content use

Service control policies

  • Deny list (usual): keep FullAWSAccess attached and add Deny statements. New services are allowed until you deny them.
  • Allow list: replace FullAWSAccess with allows for approved services only. Tighter, more upkeep, and every level in the path from root to account must allow an action for it to pass.
  • SCPs support Condition, NotAction and NotResource in both allow and deny statements. Resource in an allow must be *. Principal and NotPrincipal aren't supported, so exempt roles with an aws:PrincipalArn condition.
  • They don't apply to: the management account, service-linked roles, and principals from outside the organization calling your resources (that's what RCPs are for).
  • Common guardrails: deny organizations:LeaveOrganization, deny stopping CloudTrail or GuardDuty, deny actions outside approved Regions (with NotAction for global services), deny creating IAM users or access keys, deny root user actions in member accounts.
{
  "Sid": "ProtectSecurityTooling",
  "Effect": "Deny",
  "Action": ["cloudtrail:StopLogging", "cloudtrail:DeleteTrail", "guardduty:DeleteDetector", "config:StopConfigurationRecorder"],
  "Resource": "*",
  "Condition": { "ArnNotLike": { "aws:PrincipalArn": "arn:aws:iam::*:role/sec-breakglass" } }
}

Protecting the management account with an SCP

SCPs never restrict the management account, so no SCP can stop someone there. Keep workloads out of the management account, lock down its access, and use a delegated administrator member account for security services.

Resource control policies

  • The resource-side twin of SCPs: a ceiling on what any principal, including ones from other organizations, can do to resources in your member accounts.
  • Supported by a growing list of services, including S3, STS (role trust), KMS, SQS, Secrets Manager, DynamoDB, ECR, CloudWatch Logs and Cognito. Check the current list before relying on one.
  • RCPFullAWSAccess is attached everywhere and can't be detached, so RCPs are always deny-style.
  • Not restricted: resources in the management account, calls by service-linked roles, and AWS managed KMS keys.
  • One RCP can stop a misconfigured bucket policy from ever sharing data outside the company, however the bucket owner writes it.
{
  "Sid": "EnforceOrgOnlyAccess",
  "Effect": "Deny",
  "Principal": "*",
  "Action": ["s3:*", "sqs:*", "kms:*", "secretsmanager:*", "sts:AssumeRole"],
  "Resource": "*",
  "Condition": {
    "StringNotEqualsIfExists": { "aws:PrincipalOrgID": "o-k7pq2example" },
    "BoolIfExists": { "aws:PrincipalIsAWSService": "false" }
  }
}

Exam signal

"Ensure no resource in any account can be accessed from outside the organization, even if a developer writes a permissive resource policy" means an RCP with aws:PrincipalOrgID. "Ensure our employees can't use resources outside the organization" means an SCP (or VPC endpoint policy) with aws:ResourceOrgID.

Declarative policies

  • Set a configuration that the service itself maintains, rather than denying API calls. It holds even when a new API or feature appears that could change the setting, and it covers service-linked roles.
  • Current EC2 policy attributes: VPC Block Public Access, VPC encryption controls, EC2 serial console access, AMI block public access, Allowed AMIs, instance metadata defaults (for example IMDSv2 required), and EBS snapshot block public access.
  • Custom error messages can point users to an internal page. An account status report shows current settings before you enforce them.
  • Detaching the policy restores the previous setting.

Exam signal

"Make sure no AMI or EBS snapshot can ever be shared publicly in any account, including through APIs added later" points to a declarative policy. An SCP only denies the API calls you list today.

AI services opt-out policies

  • A management policy type that tells AWS AI services not to use or store your content for service improvement.
  • Set it once at the root for all supported services (default), or per service. Accounts can be prevented from overriding the parent's choice.
  • Opting out also deletes historical content the service kept for that purpose, but not content it needs to provide the service to you.

Data perimeters

A data perimeter is three questions, answered with three kinds of policy:

PerimeterQuestionEnforced with
IdentityOnly trusted identities can reach my resourcesRCPs and resource policies with aws:PrincipalOrgID, aws:PrincipalIsAWSService
ResourceMy identities can only reach trusted resourcesSCPs and VPC endpoint policies with aws:ResourceOrgID
NetworkAccess only from expected networksRCPs, SCPs, resource policies and endpoint policies with aws:SourceVpc, aws:SourceVpce, aws:SourceIp, aws:ViaAWSService
  • Exempt AWS services acting on your behalf with aws:PrincipalIsAWSService and aws:ViaAWSService, or the perimeter breaks CloudTrail delivery, replication and similar.
  • Roll out in stages: test in one OU, watch CloudTrail for AccessDenied, then widen.

Scenarios

Scenario
A healthcare company has 90 accounts. A recent incident involved a developer adding a bucket policy that granted read access to a contractor's personal AWS account. The CISO wants a control that prevents any principal outside the organization from reading S3 objects or retrieving secrets in any member account, regardless of the resource policy. What should the security team implement?
Scenario
A company requires IMDSv2 on every new EC2 instance in all member accounts. It wants the setting to hold even if AWS introduces new launch APIs, and to show users a link to the internal standard when a launch is rejected. What should it use?
Scenario
A security architect adds an SCP to the organization root that denies iam:CreateUser. Two weeks later, a new IAM user appears in the management account. What explains this?

Further reading

Permissions boundaries and delegation

Using permissions boundaries to let teams create their own roles without escalating privilege, controlling iam:PassRole, and how service-linked roles fit in.

Least-privilege tooling and troubleshooting

IAM Access Analyzer external, internal and unused access findings, policy validation, generation and custom checks, the IAM policy simulator, last accessed data, and reading AccessDenied messages.

On this page

Choosing the policy typeService control policiesResource control policiesDeclarative policiesAI services opt-out policiesData perimetersScenariosFurther reading