All accounts in an AWS Organization must be prevented from using Regions outside an approved list.
The guardrail must apply above permissions granted by individual account administrators.
Which control is most appropriate?
Use a service control policy (SCP) to define the maximum permissions available to accounts, including the Regions they may use.
Detailed explanation
A cache policy controls content caching and does not authorize AWS API operations.
A cache policy controls content caching and does not authorize AWS API operations.
Per-user changes are difficult to enforce consistently across the entire organization.
Per-user changes are difficult to enforce consistently across the entire organization.
An SCP applies to an organization, OU, or account and defines the maximum permissions available to principals.
An SCP applies to an organization, OU, or account and defines the maximum permissions available to principals.
An S3 resource policy does not restrict use of every AWS service by Region.
An S3 resource policy does not restrict use of every AWS service by Region.
Check official documentation
Compare the following points with the official documentation.
AWS OrganizationsのSCP公式説明を確認する。
What to confirm
組織全体の予防的ガードレールをSCPへ対応付けられる。
Key points
- Service control policy
- AWS Organizations
- Organization guardrail
Notes
- Environment: AWS公式Organizationsドキュメントの確認
- Confirm current AWS service behavior in the official documentation.
Foundation review
Maximum versus granted permissions
An SCP does not grant a permission by itself; it constrains what IAM policies can grant.
Organization scope
Applying the policy at the organization, OU, or account level avoids per-user drift.