Lion Cipher Lab
Set org-wide guardrails with AWS Organizations SCPs
- Cloud Security
- Intermediate
- ~50 min
- Free · no account required
Why it matters
Single-account security (MFA, least privilege, one baseline) stops being enough the moment a company has more than one AWS account — and most do, one per team or environment. The danger is that each account has its own admin who can turn off logging, delete guardrails, or wander into an unapproved region. Service Control Policies are the preventive control that caps what ANY admin in ANY member account can do, from a single place. Understanding SCPs is the difference between hoping every account owner behaves and provably preventing the actions you never want anyone to take. It is core to how…
What you'll learn
- AWS Organizations
- Service Control Policies (SCPs)
- multi-account governance
- preventive vs detective controls
- IAM policy JSON
- allow/deny policy evaluation
Steps in this lab
- The words first: organization, account, OU, root
- Preventive vs detective — and what an SCP actually is
- COST SAFETY FIRST — turn on a budget alert
- Open Organizations and read the real FullAWSAccess policy
- How SCP evaluation decides yes or no
- Write your own guardrail SCP (and validate it)
- Where you'd actually apply it (read-the-docs)
- Tear down and take the mental model with you