AWS Governance Framework
Service Control Policies (SCPs)
Establish a central security perimeter for your entire AWS Organization by defining maximum available permissions.
The Ingredients
AWS Organizations
The root container used to manage accounts centrally.
OU Structure
Organizational Units for grouping accounts by logic.
JSON Policies
The syntax used to define allowed or denied actions.
FullAWSAccess
The default managed SCP that allows all services.
The Governance Flow
1
Define Guardrails
Write a policy that denies specific regions or high-cost services.
2
Attach at Scale
Apply the SCP to the Root, an OU, or a specific Account.
3
Intersection Logic
Final permissions are the intersection of SCPs and IAM Policies.