AWS Service Control Policy (SCP)

AWS Service Control Policy (SCP) (Mar 2019) doc

Examples

{
    "Organization": {
        "Id": "o-pkdpvy9556",
        "Arn": "arn:aws:organizations::0987654321:organization/o-pkdpvy9556",
        "FeatureSet": "ALL",
        "MasterAccountArn": "arn:aws:organizations::0987654321:account/o-pkdpvy9556/0987654321",
        "MasterAccountId": "0987654321",
        "MasterAccountEmail": "your_username@your_email.com",
        "AvailablePolicyTypes": [
            {
                "Type": "SERVICE_CONTROL_POLICY",
                "Status": "ENABLED"
            }
        ]
    }
}

Activities

• How to revoke federated users’ active AWS sessions

Related

• AWS Organizations: aws_organizations_policy
• aws organizations describe-organization
• aws sts get-caller-identity
• Organization Units (OU)
• AWS Guardrails

See also

• AWS Service Control Policy (SCP), aws_organizations_policy
• AWS policies: managed policies, Inline, Job functions, reference, AWS trust policy, AWS Service Control Policy (SCP), Resource-based policies, Identity-based policies, permissions boundaries, "Resource":, Job function, AWS Policy Generator, s3:, lambda:, cloudwatch:, AWSSecretsManagerReadWriteAccess, actions =, resources =

https://aws.amazon.com/about-aws/whats-new/2019/03/service-control-policies-enable-fine-grained-permission-controls/