Managing AWS Service Control Policies (SCPs) Across Multiple Accounts

Overview

From small startups to huge companies, a wide range of users’ demands can be met by the vast and adaptable cloud computing environment offered by Amazon Web Services (AWS). The management and governance of AWS environments become more crucial as organizations expand their platform use. Administrators can effectively manage access to AWS services and resources across various AWS accounts in a company by implementing AWS Service Control Policies (SCPs).

Pioneers in Cloud Consulting & Migration Services

Reduced infrastructural costs
Accelerated application deployment

Get Started

Introduction

As businesses expand their use of the cloud, it can become more difficult to manage access and guarantee security across several AWS accounts. Within Amazon Organisations, AWS Service Control Policies (SCPs) offer a reliable way to control permissions centrally.

This blog examines the fundamentals of AWS SCPs, covering their salient characteristics, useful uses, and functioning.

We begin by outlining SCPs’ role in delivering account-wide rights management, granular control, hierarchical policy application, and explicit refuse overrides. It is essential to comprehend the construction and application of SCPs, and we demonstrate these ideas with concise examples. You’ll discover how to create and apply SCPs to limit actions within particular regions, control access to particular AWS services, and stop using pricey services.

AWS SCPs

You may manage permissions in your AWS environment by using a type of policy called a service control policy (SCP). Maximum permissions for an Organisational Unit (OU) or AWS Organisation are specified in SCPs, which are JSON documents. To offer thorough control over what may be done and what resources can be accessed, they are used in conjunction with AWS Identity and Access Management (IAM) policies.

Key Features of SCPs

Account-Wide Permissions Management:

SCPs guarantee uniform permission enforcement throughout your whole organization by applying to all users and roles in an AWS account.

Granular Control:

Administrators can have fine-grained control over which AWS services and operations are accessible by using SCPs to set specific permissions.

Hierarchy and Inheritance:

SCPs can be implemented at the root level, organizational unit, and individual account levels in an AWS organization. Centralized management is made possible by the inheritance of policies implemented at higher levels by lower levels.

Deny Overrides:

SCPs can explicitly deny actions that other AWS IAM policies cannot override, ensuring critical restrictions are enforced.

How does SCPs Work?

SCPs function by specifying the highest level of access that accounts within an AWS Organisation are granted. They restrict the permissions that AWS IAM policies can provide rather than giving permissions on their own. AWS IAM policy permissions notwithstanding, an action cannot be carried out if a SCP prohibits it.

Applying SCPs

To apply an SCP, follow these steps:

Create the SCP: Define the SCP in JSON format.
Attach the SCP: Attach the SCP to the desired root, organizational unit, or individual account within your AWS Organization.

Example Use Cases

Restricting Access to Specific Regions: To enforce compliance or cost-saving measures, you can restrict access to AWS services in specific regions.

{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Deny",
        "Action": "*",
        "Resource": "*",
        "Condition": {
          "StringNotEquals": {
            "aws:RequestedRegion": [
              "us-east-1",
              "us-west-2"
            ]
          }
        }
      }
    ]
  }

{

"Version": "2012-10-17",

"Statement": [

{

"Effect": "Deny",

"Action": "*",

"Resource": "*",

"Condition": {

"StringNotEquals": {

"aws:RequestedRegion": [

"us-east-1",

"us-west-2"

]

}

]

}

Disabling Costly Services: To prevent the use of certain expensive services, you can deny access to those services entirely.

{
"Version": "2012-10-17",
"Statement": [
 {
 "Effect": "Deny",
 "Action": [
 "rds:*",
 "redshift:*"
 ],
 "Resource": "*"
 }
  ]
 }

{

"Version": "2012-10-17",

"Statement": [

{

"Effect": "Deny",

"Action": [

"rds:*",

"redshift:*"

"Resource": "*"

}

]

}

Conclusion

AWS Service Control Policies are a crucial tool for controlling and managing access to AWS resources in an environment with many accounts. Utilizing SCPs, businesses can guarantee that users and services have the permissions necessary to carry out their tasks by enforcing uniform security and compliance policies throughout their AWS environment. You may more successfully manage access and lower the possibility of inadvertent activities that could harm your AWS infrastructure by implementing best practices for SCPs.

Accept the potential of SCPs to improve your AWS governance plan and keep your cloud environment safe, legal, and well-managed.

Drop a query if you have any questions regarding AWS Service Control Policies and we will get back to you quickly.

Making IT Networks Enterprise-ready – Cloud Management Services

Accelerated cloud migration
End-to-end view of the cloud environment

Get Started

About CloudThat

CloudThat is a leading provider of Cloud Training and Consulting services with a global presence in India, the USA, Asia, Europe, and Africa. Specializing in AWS, Microsoft Azure, GCP, VMware, Databricks, and more, the company serves mid-market and enterprise clients, offering comprehensive expertise in Cloud Migration, Data Platforms, DevOps, IoT, AI/ML, and more.

CloudThat is recognized as a top-tier partner with AWS and Microsoft, including the prestigious ‘Think Big’ partner award from AWS and the Microsoft Superstars FY 2023 award in Asia & India. Having trained 650k+ professionals in 500+ cloud certifications and completed 300+ consulting projects globally, CloudThat is an official AWS Advanced Consulting Partner, Microsoft Gold Partner, AWS Training Partner, AWS Migration Partner, AWS Data and Analytics Partner, AWS DevOps Competency Partner, Amazon QuickSight Service Delivery Partner, Amazon EKS Service Delivery Partner, AWS Microsoft Workload Partners, Amazon EC2 Service Delivery Partner, and many more.

To get started, go through our Consultancy page and Managed Services Package, CloudThat’s offerings.

FAQs

1. What is the main purpose of AWS Service Control Policies (SCPs)?

ANS: – Managing and controlling an AWS Organization’s account’s maximum permissions is the primary goal of AWS Service Control Policies (SCPs). SCPs ensure uniform security and compliance requirements within various AWS accounts by defining boundaries for actions permitted by IAM policies. They support the centralized management of AWS service and action access by administrators for users and roles inside their company.

2. What happens if an SCP denies a specific action but an AWS IAM policy allows it?

ANS: – Regardless of any permissions granted by IAM policies, an action is denied if a SCP expressly forbids it. Within an AWS Organisation, SCPs set the maximum permissions for accounts, allowing them to impose restrictions that IAM policies cannot overrule. As a result, an action will not be allowed even if an IAM policy permits it if the SCP forbids it.

WRITTEN BY Shakti Singh Chouhan

Shakti Singh is a Research Associate (Infra, Migration, and Security) at CloudThat. He is a passionate learner committed to learning new things every day. Shakti enjoys sharing his knowledge with others. He likes singing and listening to music in his leisure time.