Ravi Sir's Cards › AWS
Ceiling or grant?
This comparison card contrasts Ceiling or grant. SCP is described as org-level maximum permissions. It also notes grants nothing. IAM policy: Identity/resource policy that grants/denies inside an account. The card pairs SCP with guardrails for every account in an OU, and IAM policy with who can do what inside one account.
Read card text
What this card says
Ceiling or grant?
SCP
Org-level maximum permissions; grants nothing.
IAM policy
Identity/resource policy that grants/denies inside an account.
Key points
Deny LeaveOrganization in Sandbox OU.
Allow s3:GetObject to an app role.
Example
SCP Effect Deny LeaveOrganization / IAM Allow GetObject
Use when
Guardrails for every account in an OU.
Who can do what inside one account.