Service Control Policy
Definition
An AWS Organizations policy attached to an account or OU that constrains what IAM principals inside the account can do. Used in forensic readiness to deny `cloudtrail:StopLogging`, `cloudtrail:DeleteTrail` and `s3:DeleteBucketPolicy` on the audit bucket.
- Platform
- AWS Organizations
- Attached to
- Account or organizational unit (OU)
- Function
- Constrains what IAM principals can do
- Forensic use
- Deny disabling or deleting CloudTrail and audit bucket policies
Common questions
Why deny actions at the SCP level instead of relying on IAM policies alone?+
An SCP sets a hard ceiling that even an account's own administrators cannot override through IAM, so it protects logging and audit resources against a compromised or rogue account-level admin, which IAM policies within that account cannot guarantee.
What specific actions does a forensic-readiness SCP typically block?+
Common denials include stopping or deleting CloudTrail logging and removing the audit bucket's access policy, actions that would otherwise let an attacker with account access erase the evidence trail.
Related terms
- CERT-in Direction April 2022
- Direction issued under Section 70B(6) of the IT Act 2000 requiring 6-hour incident reporting, 180-day log retention in India, KYC retention by...
- Control-Plane Log
- A record of management API calls against cloud resources (create, delete, modify, attach IAM role). AWS CloudTrail, Azure Activity Log, and GCP...
- Data-Plane Log
- A record of operations on the data inside a resource: S3 object reads, KMS decrypts, database queries. Off by default in most...
- Forensic Account
- A dedicated cloud account, separate from the production account, that holds shared snapshots, the forensic analysis instance, and the chain-of-custody artefacts. Isolating...
- VM Snapshot
- A point-in-time copy of a managed disk taken at the storage layer (EBS, Azure managed disk, GCP persistent disk). Crash-consistent by default;...