{"repo":"aws-samples/service-control-policy-examples","free":true,"listed":false,"github":"https://github.com/aws-samples/service-control-policy-examples","clone":"git clone https://github.com/aws-samples/service-control-policy-examples.git","description":"Example AWS Service control policies to get started or mature your usage of AWS SCPs.","language":null,"stars":315,"topics":["aws","aws-iam","aws-organizations","aws-scp"],"license":"MIT-0","category":"deployment-docker-iac","readme_excerpt":"Service control policy examples ------------------------------------------------------------------------------ The service control policies in this repository are shown as examples. You should not attach SCPs without thoroughly testing the impact that the policy has on accounts. Once you have a policy ready that you would like to implement, we recommend testing in a separate organization or OU that can be represent your production environment. Once tested, you should deploy changes to more specific OUs and then slowly deploy the changes to broader and broader OUs over time. Service control policies (SCPs) are meant to be used as coarse-grained guardrails, and they don’t directly grant access. The administrator must still attach identity-based or resource-based policies to IAM principals or resources in your accounts to actually grant permissions. The effective permissions are the logical intersection between the Service control policy/Resource control policy and an identity policy or the Service control policy/Resource control policy and a resource policy. You can get more details about SCP effects on permissions here. A Service control policy (SCP), when attached to an AWS organization, organization unit or an account offers a central control over the maximum available permissions for all accounts in your organization, organization unit or an account. As an SCP can be applied at multiple levels in an AWS organization, understanding how SCPs are evaluated can help you write S","default_branch":null,"files":null,"tree":[],"storefront":"/r/aws-samples","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/aws-samples/service-control-policy-examples/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}