Service Control Policy
Definition
An AWS Organizations policy attached to an account or OU that constrains what IAM principals inside the account can do. Used in forensic readiness to deny `cloudtrail:StopLogging`, `cloudtrail:DeleteTrail` and `s3:DeleteBucketPolicy` on the audit bucket.
Related terms
- CERT-in Direction April 2022
- Direction issued under Section 70B(6) of the IT Act 2000 requiring 6-hour incident reporting, 180-day log retention in India, KYC retention by...
- Control-Plane Log
- A record of management API calls against cloud resources (create, delete, modify, attach IAM role). AWS CloudTrail, Azure Activity Log, and GCP...
- Data-Plane Log
- A record of operations on the data inside a resource: S3 object reads, KMS decrypts, database queries. Off by default in most...
- Forensic Account
- A dedicated cloud account, separate from the production account, that holds shared snapshots, the forensic analysis instance, and the chain-of-custody artefacts. Isolating...
- VM Snapshot
- A point-in-time copy of a managed disk taken at the storage layer (EBS, Azure managed disk, GCP persistent disk). Crash-consistent by default;...
Explained in
- Cloud Logging, VM Snapshots and Cloud Incident ResponseAn AWS Organizations policy attached to an account or OU that constrains what IAM principals inside the account can do. Used in forensic readiness to deny `clo...