Before we begin, we should talk about what SCPs are and how they apply to your organization.
An SCP consists of a policy document that defines (by way of filtering) the services and actions that can be used and performed within an OU or in an AWS account.
If you've previously configured an IAM policy, then you will have more than enough background knowledge to get started with SCPs. Apart from a couple of minor exceptions, they look exactly the same.
SCPs can be applied at different levels throughout an organization. The following are the levels, starting from the bottom and going up:
- AWS account level: An SCP that's applied to an AWS account takes effect on only that account. It's important to note that the SCP is very separate from the IAM policies that live inside the account. For example, an SCP might allow full access...
