Scp

Service Control Policies

• Management account can not be controlled by SCP
• SCPs define account permissions boundaries
• SCPs define what an account including account root user can do
• While account root user still has unrestricted access to an account, SCPs put boundaries on what an account can do & hence restrict account root user indirectly
• Service control policies do not grant new permissions to identities. They only restrict permissions given to identities
• Service control policies can function either as
• Allow List - I.E Deny by default but allow specific access
• Deny List - I.E. Allow by default but block specific access. This is the default for SCP.
• As Deny List is default i.e. by default SCPs allow full access or in other words by default they have no effect