How does a service control policy(SCP) differ from an IAM policy?

Question

Mahesh B · Accepted Answer

An SCP (Service Control Policy) is used to set maximum permission boundaries at the organizational level, while IAM policies are used to grant specific permissions to users, groups, or roles within an individual AWS account. SCPs help enforce governance across multiple accounts, whereas IAM policies control access to resources within a single account.

Dhananjeyan Gopal · Answer

The main differences between the SCP and IAM policies are 1. Scope: SCPs apply at the organization or OU level, while IAM policies are applied at the user, group, or role level within an individual AWS account. 2. Permissions Granting: IAM policies grant permissions, whereas SCPs only restrict or filter permissions. 3. Hierarchy: SCPs are at the top of the permission hierarchy in AWS. Even if an IAM policy grants a permission, an SCP can override this by denying it.

How does a service control policy(SCP) differ from an IAM policy?

Ekasquest - Cloud Computing, DevOps & Tech Q&A Community verfügbar in

Ekasquest - Cloud Computing, DevOps & Tech Q&A Community verfügbar in